CVE-2023-28846

Name of the Vulnerable Software and Affected Versions unpoly-rails versions prior to 2.7.2.2

Description The issue is related to a possible Denial of Service (DoS) vulnerability in the unpoly-rails gem. This affects Rails applications operating as an upstream of a load balancer that uses passive health checks. The unpoly-rails gem echoes the request URL as an X-Up-Location response header. By making a request with exceedingly long URLs, an attacker can cause unpoly-rails to write a large response header. If the response header is too large to be parsed by a load balancer downstream of the Rails application, it may cause the load balancer to remove the upstream from a load balancing group, making the application instance unavailable until a configured timeout is reached or until an active healthcheck succeeds.

Recommendations To resolve the issue, upgrade to version 2.7.2.2 or later. If unable to upgrade, consider the following workarounds:

after action :remove redundant up location header

private

def remove redundant up location header
 if request.original url == response.headers['X-Up-Location']
  response.headers.delete('X-Up-Location')
 end
end