Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Tools/GitHubGitHub/ooooooo-q/puma_header_normalization-cve-2024-45614
Vulnerability AnalysisWeb SecurityPenetration TestingLearning & EducationLabs & Practice
GitHubooooooo-q/puma_header_normalization-cve-2024-45614

puma_header_normalization-CVE-2024-45614

Puma Header normalization CVE-2024-45614 確認

View Repository
31 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Puma Header normalization CVE-2024-45614 Verification

  • advisory: https://github.com/puma/puma/security/advisories/GHSA-9hf4-67fc-4vf4
  • fix commit: https://github.com/puma/puma/commit/cac3fd18cf29ed43719ff5d52d9cfec215f0a043

Results

Execution results of request.rb

duplicate

TargetResult
puma_before_fix_rack2X_FORWARDED_FOR: 2.2.2.2
puma_before_fix_rack3X_FORWARDED_FOR: 2.2.2.2
puma_after_fix_rack2X_FORWARDED_FOR: 2.2.2.2
puma_after_fix_rack3X_FORWARDED_FOR: 2.2.2.2
pitchfork_rack2X_FORWARDED_FOR: 2.2.2.2
pitchfork_rack3X_FORWARDED_FOR: 2.2.2.2
unicorn_rack2X_FORWARDED_FOR: 2.2.2.2
unicorn_rack3X_FORWARDED_FOR: 2.2.2.2
thin_rack2X_FORWARDED_FOR: 2.2.2.2
falcon_rack3X_FORWARDED_FOR: 2.2.2.2
nginx_unicorn_rack2X_FORWARDED_FOR: 2.2.2.2
nginx_unicorn_rack2_underscore_onX_FORWARDED_FOR: 2.2.2.2

under_score

TargetResult
puma_before_fix_rack2X_FORWARDED_FOR: 2.2.2.2
puma_before_fix_rack3X_FORWARDED_FOR: 2.2.2.2
puma_after_fix_rack2X_FORWARDED_FOR: 1.1.1.1
puma_after_fix_rack3X_FORWARDED_FOR: 1.1.1.1
pitchfork_rack2X_FORWARDED_FOR: 1.1.1.1,2.2.2.2
pitchfork_rack3X_FORWARDED_FOR: 1.1.1.1,2.2.2.2
unicorn_rack2X_FORWARDED_FOR: 1.1.1.1,2.2.2.2
unicorn_rack3X_FORWARDED_FOR: 1.1.1.1,2.2.2.2
thin_rack2X_FORWARDED_FOR: 2.2.2.2
falcon_rack3X_FORWARDED_FOR: 1.1.1.1,2.2.2.2
nginx_unicorn_rack2X_FORWARDED_FOR: 1.1.1.1
nginx_unicorn_rack2_underscore_onX_FORWARDED_FOR: 1.1.1.1,2.2.2.2

reverse_under_score

TargetResult
puma_before_fix_rack2X_FORWARDED_FOR: 1.1.1.1
puma_before_fix_rack3X_FORWARDED_FOR: 1.1.1.1
puma_after_fix_rack2X_FORWARDED_FOR: 2.2.2.2
puma_after_fix_rack3X_FORWARDED_FOR: 2.2.2.2
pitchfork_rack2X_FORWARDED_FOR: 1.1.1.1,2.2.2.2
pitchfork_rack3X_FORWARDED_FOR: 1.1.1.1,2.2.2.2
unicorn_rack2X_FORWARDED_FOR: 1.1.1.1,2.2.2.2
unicorn_rack3X_FORWARDED_FOR: 1.1.1.1,2.2.2.2
thin_rack2X_FORWARDED_FOR: 2.2.2.2
falcon_rack3X_FORWARDED_FOR: 1.1.1.1,2.2.2.2
nginx_unicorn_rack2X_FORWARDED_FOR: 2.2.2.2
nginx_unicorn_rack2_underscore_onX_FORWARDED_FOR: 1.1.1.1,2.2.2.2

upper_case

TargetResult
puma_before_fix_rack2X_FORWARDED_FOR: 2.2.2.2
puma_before_fix_rack3X_FORWARDED_FOR: 2.2.2.2
puma_after_fix_rack2X_FORWARDED_FOR: 2.2.2.2
puma_after_fix_rack3X_FORWARDED_FOR: 2.2.2.2
pitchfork_rack2X_FORWARDED_FOR: 2.2.2.2
pitchfork_rack3X_FORWARDED_FOR: 2.2.2.2
unicorn_rack2X_FORWARDED_FOR: 2.2.2.2
unicorn_rack3X_FORWARDED_FOR: 2.2.2.2
thin_rack2X_FORWARDED_FOR: 2.2.2.2
falcon_rack3X_FORWARDED_FOR: 2.2.2.2
nginx_unicorn_rack2X_FORWARDED_FOR: 2.2.2.2
nginx_unicorn_rack2_underscore_onX_FORWARDED_FOR: 2.2.2.2

reverse_upper_case

TargetResult
puma_before_fix_rack2X_FORWARDED_FOR: 2.2.2.2
puma_before_fix_rack3X_FORWARDED_FOR: 2.2.2.2
puma_after_fix_rack2X_FORWARDED_FOR: 2.2.2.2
puma_after_fix_rack3X_FORWARDED_FOR: 2.2.2.2
pitchfork_rack2X_FORWARDED_FOR: 2.2.2.2
pitchfork_rack3X_FORWARDED_FOR: 2.2.2.2
unicorn_rack2X_FORWARDED_FOR: 2.2.2.2
unicorn_rack3X_FORWARDED_FOR: 2.2.2.2
thin_rack2X_FORWARDED_FOR: 2.2.2.2
falcon_rack3X_FORWARDED_FOR: 2.2.2.2
nginx_unicorn_rack2X_FORWARDED_FOR: 2.2.2.2
nginx_unicorn_rack2_underscore_onX_FORWARDED_FOR: 2.2.2.2

Starting each server

Puma

root@kitploit:~
# Before CVE-2024-45614 fix Rack2
$ cd puma_before_fix_rack2 
$ RACK_ENV=production bundle exec puma -p 9000 ../config.ru

# Before CVE-2024-45614 fix Rack3
$ cd puma_before_fix_rack3 
$ RACK_ENV=production bundle exec puma -p 9001 ../config.ru

# After CVE-2024-45614 fix Rack2
$ cd puma_after_fix_rack2
$ RACK_ENV=production bundle exec puma -p 9002 ../config.ru

# After CVE-2024-45614 fix Rack3
$ cd puma_after_fix_rack2 
$ RACK_ENV=production bundle exec puma -p 9003 ../config.ru

Pitchfork

root@kitploit:~
# Rack2
$ cd pitchfork_rack2 
$ RACK_ENV=production bundle exec pitchfork -p 9010 ../config.ru

# Rack3
$ cd pitchfork_rack3 
$ RACK_ENV=production bundle exec pitchfork -p 9011 ../config.ru

Unicorn

root@kitploit:~
# Rack2
$ cd unicorn_rack2 
$ RACK_ENV=production bundle exec unicorn -p 9020 ../config.ru

# Rack3
# * At the time of investigation, Rack3 support was not complete, but the server runs
$ cd unicorn_rack3 
$ RACK_ENV=production bundle exec unicorn -p 9021 ../config.ru

Thin

root@kitploit:~
# Rack2
$ cd thin_rack2 
$ RACK_ENV=production bundle exec thin start -p 9030 -R ../config.ru

# Rack3
# * The version under investigation does not support Rack3, so bundle install cannot be performed

Falcon

  • Start with HTTP1 for easier verification
root@kitploit:~
# Rack2
$ cd falcon_rack2 
$ RACK_ENV=production bundle exec rackup --server falcon -p 9040 ../config.ru
# * Could not run

# Rack3
$ cd falcon_rack3 
$ RACK_ENV=production bundle exec rackup --server falcon -p 9041 ../config.ru

Nginx

root@kitploit:~
$ docker run --name heade_test_nginx -v $(pwd)/nginx.conf:/etc/nginx/nginx.conf:ro -d -p 9100:80 -p 9101:81 nginx
Download Tool