Skip to content
KitploitKITPLOIT
HerramientasBlog
Enviar
HerramientasBlog
Enviar

¡Herramientas de Hacking, PenTest y Ciberseguridad para tu Arsenal de Seguridad!

Kitploit es un directorio de herramientas de hacking, ciberseguridad y pentesting. Descubre las últimas actualizaciones de proyectos para encontrar vulnerabilidades, analizar sistemas, automatizar pruebas y fortalecer tu seguridad.

··Feeds·Contacto·Privacidad·© 2026 Kitploit

Directorio de Herramientas

Categorías

Ver todas las categorías
Loading categories
puma_header_normalization-CVE-2024-45614 — Puma Normalización de cabeceras CVE-2024-45614 Verificación | Kitploit
Herramientas/GitHubGitHub/ooooooo-q/puma_header_normalization-cve-2024-45614
Análisis de VulnerabilidadesSeguridad WebPruebas de PenetraciónAprendizaje y EducaciónLabs y Práctica
GitHubooooooo-q/puma_header_normalization-cve-2024-45614

puma_header_normalization-CVE-2024-45614

Puma Normalización de cabeceras CVE-2024-45614 Verificación

Ver Repositorio
3hace 1 añoAún no revisado

Más Populares

Ver todos →

Descubre las herramientas más usadas por nuestra comunidad.

Explora todas las herramientas

Explora nuestra colección de herramientas

Ver todas las herramientas →
Compartir

Verificación de la normalización de encabezados de Puma CVE-2024-45614

===

  • aviso: https://github.com/puma/puma/security/advisories/GHSA-9hf4-67fc-4vf4
  • commit de corrección: https://github.com/puma/puma/commit/cac3fd18cf29ed43719ff5d52d9cfec215f0a043

Resultados

Resultado de la ejecución de request.rb

duplicate

ObjetivoResultado
puma_before_fix_rack2X_FORWARDED_FOR: 2.2.2.2
puma_before_fix_rack3X_FORWARDED_FOR: 2.2.2.2
puma_after_fix_rack2X_FORWARDED_FOR: 2.2.2.2
puma_after_fix_rack3X_FORWARDED_FOR: 2.2.2.2
pitchfork_rack2X_FORWARDED_FOR: 2.2.2.2
pitchfork_rack3X_FORWARDED_FOR: 2.2.2.2
unicorn_rack2X_FORWARDED_FOR: 2.2.2.2
unicorn_rack3X_FORWARDED_FOR: 2.2.2.2
thin_rack2X_FORWARDED_FOR: 2.2.2.2
falcon_rack3X_FORWARDED_FOR: 2.2.2.2
nginx_unicorn_rack2X_FORWARDED_FOR: 2.2.2.2
nginx_unicorn_rack2_underscore_onX_FORWARDED_FOR: 2.2.2.2

under_score

ObjetivoResultado
puma_before_fix_rack2X_FORWARDED_FOR: 2.2.2.2
puma_before_fix_rack3X_FORWARDED_FOR: 2.2.2.2
puma_after_fix_rack2X_FORWARDED_FOR: 1.1.1.1
puma_after_fix_rack3X_FORWARDED_FOR: 1.1.1.1
pitchfork_rack2X_FORWARDED_FOR: 1.1.1.1,2.2.2.2
pitchfork_rack3X_FORWARDED_FOR: 1.1.1.1,2.2.2.2
unicorn_rack2X_FORWARDED_FOR: 1.1.1.1,2.2.2.2
unicorn_rack3X_FORWARDED_FOR: 1.1.1.1,2.2.2.2
thin_rack2X_FORWARDED_FOR: 2.2.2.2
falcon_rack3X_FORWARDED_FOR: 1.1.1.1,2.2.2.2
nginx_unicorn_rack2X_FORWARDED_FOR: 1.1.1.1
nginx_unicorn_rack2_underscore_onX_FORWARDED_FOR: 1.1.1.1,2.2.2.2

reverse_under_score

ObjetivoResultado
puma_before_fix_rack2X_FORWARDED_FOR: 1.1.1.1
puma_before_fix_rack3X_FORWARDED_FOR: 1.1.1.1
puma_after_fix_rack2X_FORWARDED_FOR: 2.2.2.2
puma_after_fix_rack3X_FORWARDED_FOR: 2.2.2.2
pitchfork_rack2X_FORWARDED_FOR: 1.1.1.1,2.2.2.2
pitchfork_rack3X_FORWARDED_FOR: 1.1.1.1,2.2.2.2
unicorn_rack2X_FORWARDED_FOR: 1.1.1.1,2.2.2.2
unicorn_rack3X_FORWARDED_FOR: 1.1.1.1,2.2.2.2
thin_rack2X_FORWARDED_FOR: 2.2.2.2
falcon_rack3X_FORWARDED_FOR: 1.1.1.1,2.2.2.2
nginx_unicorn_rack2X_FORWARDED_FOR: 2.2.2.2
nginx_unicorn_rack2_underscore_onX_FORWARDED_FOR: 1.1.1.1,2.2.2.2

upper_case

ObjetivoResultado
puma_before_fix_rack2X_FORWARDED_FOR: 2.2.2.2
puma_before_fix_rack3X_FORWARDED_FOR: 2.2.2.2
puma_after_fix_rack2X_FORWARDED_FOR: 2.2.2.2
puma_after_fix_rack3X_FORWARDED_FOR: 2.2.2.2
pitchfork_rack2X_FORWARDED_FOR: 2.2.2.2
pitchfork_rack3X_FORWARDED_FOR: 2.2.2.2
unicorn_rack2X_FORWARDED_FOR: 2.2.2.2
unicorn_rack3X_FORWARDED_FOR: 2.2.2.2
thin_rack2X_FORWARDED_FOR: 2.2.2.2
falcon_rack3X_FORWARDED_FOR: 2.2.2.2
nginx_unicorn_rack2X_FORWARDED_FOR: 2.2.2.2
nginx_unicorn_rack2_underscore_onX_FORWARDED_FOR: 2.2.2.2

reverse_upper_case

ObjetivoResultado
puma_before_fix_rack2X_FORWARDED_FOR: 2.2.2.2
puma_before_fix_rack3X_FORWARDED_FOR: 2.2.2.2
puma_after_fix_rack2X_FORWARDED_FOR: 2.2.2.2
puma_after_fix_rack3X_FORWARDED_FOR: 2.2.2.2
pitchfork_rack2X_FORWARDED_FOR: 2.2.2.2
pitchfork_rack3X_FORWARDED_FOR: 2.2.2.2
unicorn_rack2X_FORWARDED_FOR: 2.2.2.2
unicorn_rack3X_FORWARDED_FOR: 2.2.2.2
thin_rack2X_FORWARDED_FOR: 2.2.2.2
falcon_rack3X_FORWARDED_FOR: 2.2.2.2
nginx_unicorn_rack2X_FORWARDED_FOR: 2.2.2.2
nginx_unicorn_rack2_underscore_onX_FORWARDED_FOR: 2.2.2.2

Inicio de cada servidor

Puma

root@kitploit:~
# CVE-2024-45614修正前 Rack2
$ cd puma_before_fix_rack2 
$ RACK_ENV=production bundle exec puma -p 9000 ../config.ru

# CVE-2024-45614修正前 Rack3
$ cd puma_before_fix_rack3 
$ RACK_ENV=production bundle exec puma -p 9001 ../config.ru

# CVE-2024-45614修正後 Rack2
$ cd puma_after_fix_rack2
$ RACK_ENV=production bundle exec puma -p 9002 ../config.ru

# CVE-2024-45614修正後 Rack3
$ cd puma_after_fix_rack2 
$ RACK_ENV=production bundle exec puma -p 9003 ../config.ru

Pitchfork

root@kitploit:~
# Rack2
$ cd pitchfork_rack2 
$ RACK_ENV=production bundle exec pitchfork -p 9010 ../config.ru

# Rack3
$ cd pitchfork_rack3 
$ RACK_ENV=production bundle exec pitchfork -p 9011 ../config.ru

Unicorn

root@kitploit:~
# Rack2
$ cd unicorn_rack2 
$ RACK_ENV=production bundle exec unicorn -p 9020 ../config.ru

# Rack3
# * 調査時のバージョンではRack3の対応は完了していないが、サーバは動く
$ cd unicorn_rack3 
$ RACK_ENV=production bundle exec unicorn -p 9021 ../config.ru

Thin

root@kitploit:~
# Rack2
$ cd thin_rack2 
$ RACK_ENV=production bundle exec thin start -p 9030 -R ../config.ru

# Rack3
# * 調査のバージョンではRack3に未対応であり、bundle installができない

Falcon

  • Se inicia con HTTP1 para facilitar la comprobación
root@kitploit:~
# Rack2
$ cd falcon_rack2 
$ RACK_ENV=production bundle exec rackup --server falcon -p 9040 ../config.ru
# * 動かせていない

# Rack3
$ cd falcon_rack3 
$ RACK_ENV=production bundle exec rackup --server falcon -p 9041 ../config.ru

Nginx

root@kitploit:~
$ docker run --name heade_test_nginx -v $(pwd)/nginx.conf:/etc/nginx/nginx.conf:ro -d -p 9100:80 -p 9101:81 nginx
Descargar herramienta