Ioquatix

Rack is a modular Ruby web server interface. A potential information disclosure issue existed in `Rack::Sendfile` when operating behind a proxy supporting `x-sendfile` headers, such as Nginx. Maliciously crafted headers could lead `Rack::Sendfile` to incorrectly communicate with the proxy, potentially circumventing proxy-level access restrictions. Specifically, when receiving untrusted `x-sendfile-type` or `x-accel-mapping` headers, the middleware could be tricked into sending a redirect response to the proxy, triggering a new internal request that bypasses access controls. An attacker could exploit this by setting a crafted `x-sendfile-type: x-accel-redirect` header and a crafted `x-accel-mapping` header, requesting a path that qualifies for proxy-based acceleration. This could expose sensitive application routes. The issue requires the application to use `Rack::Sendfile` with a proxy that supports `x-accel-redirect`, the proxy not consistently setting or removing the `x-sendfile-type` and `x-accel-mapping` headers, and the application exposing an endpoint that returns a body responding to `.to path`.

The issue is related to a denial of service vulnerability due to the lack of constraints on user-controlled data `profiler runs`. This allows for the allocation of resources on the server side with no limitation, potentially leading to a denial of service by remotely controlled data. The vulnerability is caused by the fact that the `profiler runs` variable is not constrained to any limitation, which would lead to allocating resources on the server side with no limitation.