Skip to content
KitploitKITPLOIT
StrumentiBlog
Invia
StrumentiBlog
Invia

Strumenti di Hacking, PenTest e Cybersecurity per il tuo Arsenale di Sicurezza!

Kitploit è una directory di strumenti di hacking, cybersecurity e pentesting. Scopri gli ultimi aggiornamenti dei progetti per trovare vulnerabilità, analizzare sistemi, automatizzare i test e rafforzare la tua sicurezza.

··Feed·Contatto·Privacy·© 2026 Kitploit

Directory degli strumenti

Categorie

Vedi tutte le categorie
Loading categories
puma_header_normalization-CVE-2024-45614 — Normalizzazione header Puma: verifica CVE-2024-45614 | Kitploit
Strumenti/GitHubGitHub/ooooooo-q/puma_header_normalization-cve-2024-45614
Analisi delle VulnerabilitàSicurezza WebPenetration TestingApprendimento e FormazioneLab e Pratica
GitHubooooooo-q/puma_header_normalization-cve-2024-45614

puma_header_normalization-CVE-2024-45614

Normalizzazione header Puma: verifica CVE-2024-45614

Vedi Repository
31 anno faNon ancora revisionato

Più Popolari

Vedi tutti →

Scopri gli strumenti più utilizzati dalla nostra community.

Esplora tutti gli strumenti

Sfoglia la nostra collezione di strumenti

Vedi tutti gli strumenti →
Condividi

Puma Header normalization CVE-2024-45614 Verifica

===

  • advisory: https://github.com/puma/puma/security/advisories/GHSA-9hf4-67fc-4vf4
  • Commit di correzione: https://github.com/puma/puma/commit/cac3fd18cf29ed43719ff5d52d9cfec215f0a043

Risultati

Risultati dell'esecuzione di request.rb

duplicate

TargetRisultato
puma_before_fix_rack2X_FORWARDED_FOR: 2.2.2.2
puma_before_fix_rack3X_FORWARDED_FOR: 2.2.2.2
puma_after_fix_rack2X_FORWARDED_FOR: 2.2.2.2
puma_after_fix_rack3X_FORWARDED_FOR: 2.2.2.2
pitchfork_rack2X_FORWARDED_FOR: 2.2.2.2
pitchfork_rack3X_FORWARDED_FOR: 2.2.2.2
unicorn_rack2X_FORWARDED_FOR: 2.2.2.2
unicorn_rack3X_FORWARDED_FOR: 2.2.2.2
thin_rack2X_FORWARDED_FOR: 2.2.2.2
falcon_rack3X_FORWARDED_FOR: 2.2.2.2
nginx_unicorn_rack2X_FORWARDED_FOR: 2.2.2.2
nginx_unicorn_rack2_underscore_onX_FORWARDED_FOR: 2.2.2.2

under_score

TargetRisultato
puma_before_fix_rack2X_FORWARDED_FOR: 2.2.2.2
puma_before_fix_rack3X_FORWARDED_FOR: 2.2.2.2
puma_after_fix_rack2X_FORWARDED_FOR: 1.1.1.1
puma_after_fix_rack3X_FORWARDED_FOR: 1.1.1.1
pitchfork_rack2X_FORWARDED_FOR: 1.1.1.1,2.2.2.2
pitchfork_rack3X_FORWARDED_FOR: 1.1.1.1,2.2.2.2
unicorn_rack2X_FORWARDED_FOR: 1.1.1.1,2.2.2.2
unicorn_rack3X_FORWARDED_FOR: 1.1.1.1,2.2.2.2
thin_rack2X_FORWARDED_FOR: 2.2.2.2
falcon_rack3X_FORWARDED_FOR: 1.1.1.1,2.2.2.2
nginx_unicorn_rack2X_FORWARDED_FOR: 1.1.1.1
nginx_unicorn_rack2_underscore_onX_FORWARDED_FOR: 1.1.1.1,2.2.2.2

reverse_under_score

TargetRisultato
puma_before_fix_rack2X_FORWARDED_FOR: 1.1.1.1
puma_before_fix_rack3X_FORWARDED_FOR: 1.1.1.1
puma_after_fix_rack2X_FORWARDED_FOR: 2.2.2.2
puma_after_fix_rack3X_FORWARDED_FOR: 2.2.2.2
pitchfork_rack2X_FORWARDED_FOR: 1.1.1.1,2.2.2.2
pitchfork_rack3X_FORWARDED_FOR: 1.1.1.1,2.2.2.2
unicorn_rack2X_FORWARDED_FOR: 1.1.1.1,2.2.2.2
unicorn_rack3X_FORWARDED_FOR: 1.1.1.1,2.2.2.2
thin_rack2X_FORWARDED_FOR: 2.2.2.2
falcon_rack3X_FORWARDED_FOR: 1.1.1.1,2.2.2.2
nginx_unicorn_rack2X_FORWARDED_FOR: 2.2.2.2
nginx_unicorn_rack2_underscore_onX_FORWARDED_FOR: 1.1.1.1,2.2.2.2

upper_case

TargetRisultato
puma_before_fix_rack2X_FORWARDED_FOR: 2.2.2.2
puma_before_fix_rack3X_FORWARDED_FOR: 2.2.2.2
puma_after_fix_rack2X_FORWARDED_FOR: 2.2.2.2
puma_after_fix_rack3X_FORWARDED_FOR: 2.2.2.2
pitchfork_rack2X_FORWARDED_FOR: 2.2.2.2
pitchfork_rack3X_FORWARDED_FOR: 2.2.2.2
unicorn_rack2X_FORWARDED_FOR: 2.2.2.2
unicorn_rack3X_FORWARDED_FOR: 2.2.2.2
thin_rack2X_FORWARDED_FOR: 2.2.2.2
falcon_rack3X_FORWARDED_FOR: 2.2.2.2
nginx_unicorn_rack2X_FORWARDED_FOR: 2.2.2.2
nginx_unicorn_rack2_underscore_onX_FORWARDED_FOR: 2.2.2.2

reverse_upper_case

TargetRisultato
puma_before_fix_rack2X_FORWARDED_FOR: 2.2.2.2
puma_before_fix_rack3X_FORWARDED_FOR: 2.2.2.2
puma_after_fix_rack2X_FORWARDED_FOR: 2.2.2.2
puma_after_fix_rack3X_FORWARDED_FOR: 2.2.2.2
pitchfork_rack2X_FORWARDED_FOR: 2.2.2.2
pitchfork_rack3X_FORWARDED_FOR: 2.2.2.2
unicorn_rack2X_FORWARDED_FOR: 2.2.2.2
unicorn_rack3X_FORWARDED_FOR: 2.2.2.2
thin_rack2X_FORWARDED_FOR: 2.2.2.2
falcon_rack3X_FORWARDED_FOR: 2.2.2.2
nginx_unicorn_rack2X_FORWARDED_FOR: 2.2.2.2
nginx_unicorn_rack2_underscore_onX_FORWARDED_FOR: 2.2.2.2

Avvio dei singoli server

Puma

root@kitploit:~
# CVE-2024-45614修正前 Rack2
$ cd puma_before_fix_rack2 
$ RACK_ENV=production bundle exec puma -p 9000 ../config.ru

# CVE-2024-45614修正前 Rack3
$ cd puma_before_fix_rack3 
$ RACK_ENV=production bundle exec puma -p 9001 ../config.ru

# CVE-2024-45614修正後 Rack2
$ cd puma_after_fix_rack2
$ RACK_ENV=production bundle exec puma -p 9002 ../config.ru

# CVE-2024-45614修正後 Rack3
$ cd puma_after_fix_rack2 
$ RACK_ENV=production bundle exec puma -p 9003 ../config.ru

Pitchfork

root@kitploit:~
# Rack2
$ cd pitchfork_rack2 
$ RACK_ENV=production bundle exec pitchfork -p 9010 ../config.ru

# Rack3
$ cd pitchfork_rack3 
$ RACK_ENV=production bundle exec pitchfork -p 9011 ../config.ru

Unicorn

root@kitploit:~
# Rack2
$ cd unicorn_rack2 
$ RACK_ENV=production bundle exec unicorn -p 9020 ../config.ru

# Rack3
# * 調査時のバージョンではRack3の対応は完了していないが、サーバは動く
$ cd unicorn_rack3 
$ RACK_ENV=production bundle exec unicorn -p 9021 ../config.ru

Thin

root@kitploit:~
# Rack2
$ cd thin_rack2 
$ RACK_ENV=production bundle exec thin start -p 9030 -R ../config.ru

# Rack3
# * 調査のバージョンではRack3に未対応であり、bundle installができない

Falcon

  • Avviato con HTTP1 per facilitare la verifica
root@kitploit:~
# Rack2
$ cd falcon_rack2 
$ RACK_ENV=production bundle exec rackup --server falcon -p 9040 ../config.ru
# * 動かせていない

# Rack3
$ cd falcon_rack3 
$ RACK_ENV=production bundle exec rackup --server falcon -p 9041 ../config.ru

Nginx

root@kitploit:~
$ docker run --name heade_test_nginx -v $(pwd)/nginx.conf:/etc/nginx/nginx.conf:ro -d -p 9100:80 -p 9101:81 nginx
Scarica lo strumento