Cached redirect poisoning via X-Forwarded-Host header
A user supplied X-Forwarded-Host header can be used to perform cache poisoning of a cache fronting a Ratpack server if the cache key does not include the X-Forwarded-Host header as a cache key.
Users are only vulnerable if they do not configure a custom PublicAddress instance. A custom PublicAddress can be specified by using ServerConfigBuilder::publicAddress. For versions prior to 1.9.0, by default, Ratpack utilizes an inferring version of PublicAddress which is vulnerable.
Impact
This can be used to perform redirect cache poisoning where an attacker can force a cached redirect to redirect to their site instead of the intended redirect location.
Patches
As of Ratpack 1.9.0, two changes have been made that mitigate this vulnerability:
- The default PublicAddress implementation no longer infers the address from the request context, instead relying on the configured bind host/port
- Relative redirects issued by the application are no longer absolutized; they are passed through as-is
Workarounds
In production, ensure that ServerConfigBuilder::publicAddress correctly configures the server.
References
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | io.ratpack:ratpack-core | < 1.9.0 | 1.9.0 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L- Weakness (CWE)
CWE-807- Platform
- Java / Kotlin (Maven)
- Package
io.ratpack:ratpack-core- Disclosed
- 01.07.2021
- Updated
- 11.10.2026 12:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-w6rq-6h34-vh7q - CC BY 4.0
Vulnerability history: io.ratpack:ratpack-core
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 4
- First → latest
- 10.2019 07.2021
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 2
- Medium 1
Disclosures per year
- 2019: 1
- 2020: 1
- 2021: 2
- 2022: 0
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 0
-
Cached redirect poisoning via X-Forwarded-Host header this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.