CVE-2024-45614

What it actually does

The flaw is an HTTP header normalization issue in Puma where client-supplied headers containing underscores can collide with or override semantically equivalent headers containing hyphens that were set by an intermediate proxy. For example, a proxy may set a trusted header such as X-Forwarded-For, X-Forwarded-Proto, or X-Forwarded-Host, while an attacker sends X-Forwarded_For, X-Forwarded_Proto, or X-Forwarded_Host. If the application or framework trusts the resulting request environment as proxy-authoritative, attacker-controlled values may be used for client IP attribution, request scheme determination, host generation, redirect logic, or security decisions. The most likely impacts are trust-boundary bypass, incorrect scheme or host handling, forced HTTP downgrade behavior, incorrect redirects, misleading audit logs, and confidentiality exposure when combined with an additional network-positioned attacker capable of intercepting downgraded or redirected traffic.

Why it matters to the business

Applications behind reverse proxies or load balancers may make incorrect decisions about where a request came from and whether it was received securely. This can lead to broken access controls that depend on client IP, inaccurate fraud or audit records, unsafe redirects, or exposure of sensitive data if users are redirected or downgraded to insecure HTTP in combination with a separate man-in-the-middle condition. The vulnerability is not currently in the CISA Known Exploited Vulnerabilities catalog, is not associated with known ransomware use, and has a low EPSS score, so urgency is moderate; however, internet-facing Ruby applications using Puma behind trusted proxies should still remediate because proxy-header trust issues are often easy to probe remotely and can undermine security controls in application-specific ways.

How an attack unfolds

An attacker sends a crafted HTTP request directly to an application served by an affected Puma version, usually through the normal public proxy or load balancer path. The request includes an underscore variant of a proxy-controlled header, such as X-Forwarded_Proto or X-Forwarded_For, intended to collide with the hyphenated header that the proxy normally injects. When Puma processes the request, the attacker-supplied underscore header can clobber or take precedence over the value that the application expected to receive only from the trusted proxy. Downstream application code, middleware, or framework logic may then treat the attacker-controlled value as authoritative. Depending on how the application uses these headers, the attacker may spoof the perceived source IP address, alter generated absolute URLs, influence redirect destinations, make the application believe the request used HTTP instead of HTTPS, or trigger behavior that exposes data if another attacker can intercept insecure traffic. Successful exploitation depends heavily on application behavior and whether trusted proxy headers are used for security decisions.

How to fix it

Upgrade Puma to a fixed release or source revision that includes commit e867e53aa4e7df91fa97d8995a80fc2f9466a080. For deployments built from Git, ensure the Puma dependency is at or after that commit. For package-managed deployments, update the puma gem or downstream package to a vendor release that incorporates the fix, then rebuild and redeploy affected applications. As defense in depth, configure reverse proxies, ingress controllers, and load balancers to drop or reject client-supplied forwarded headers before setting their own trusted values, including underscore variants. Prefer a single normalized forwarding-header policy, disable or reject underscores in request headers where possible, and ensure applications only trust forwarded headers from explicitly trusted proxy IP ranges. Review application logic for security decisions based on X-Forwarded-For, X-Forwarded-Proto, X-Forwarded-Host, Forwarded, X-Real-IP, or similar headers.

How to confirm the fix worked

Confirm the deployed Puma version or source revision includes commit e867e53aa4e7df91fa97d8995a80fc2f9466a080 or a release containing it. Validate dependency manifests, lockfiles, container images, and runtime package inventories rather than only source repositories. In a non-production test environment, send requests containing both proxy-set hyphenated headers and client-controlled underscore variants, then verify that application-observed values cannot be overridden by the underscore form. Test representative security-sensitive behaviors, including perceived client IP, request scheme, generated absolute URLs, redirect targets, HSTS behavior, and IP-based allow or deny logic. Confirm proxy-layer controls reject or strip inbound headers such as X-Forwarded_For, X-Forwarded_Proto, and X-Forwarded_Host before the request reaches Puma.

Typical attack path

1. Identify a Ruby web application or API served by Puma and positioned behind a reverse proxy, CDN, ingress controller, or load balancer.
2. Determine whether the application behavior changes based on forwarded headers, such as client IP, scheme, host, or SSL indicators.
3. Send requests containing underscore variants of trusted proxy headers, such as X-Forwarded_For, X-Forwarded_Proto, or X-Forwarded_Host.
4. Observe whether the application uses the attacker-provided underscore header value instead of the proxy-supplied hyphenated value.
5. Abuse the resulting trust confusion to spoof source IP, influence redirects, alter URL generation, bypass IP-based restrictions, or force insecure scheme handling.
6. If combined with a separate man-in-the-middle capability, exploit HTTP downgrade or unsafe redirect behavior to observe or tamper with sensitive traffic.

How to detect it

Look for evidence of probing or exploitation by searching edge proxy, CDN, load balancer, ingress, web server, WAF, and application logs for inbound request headers that use underscores instead of hyphens for proxy-related fields. High-signal events include X-Forwarded_For, X-Forwarded_Proto, X-Forwarded_Host, X-Forwarded_Port, X-Real_IP, or similar headers arriving from external clients, especially when the same request also contains normal proxy-added hyphenated headers or results in redirects, scheme changes, host changes, authorization changes, or anomalous source-IP attribution. Review application logs for mismatches between edge-observed client IP and application-recorded client IP, unexpected http scheme values behind TLS-terminating proxies, redirects to unexpected hosts or HTTP URLs, and requests that appear to bypass IP-based restrictions. If full HTTP header logging is unavailable, inspect WAF events, reverse proxy debug logs, request traces, APM captures, and sampled access logs. Because exploitation may not leave a unique payload beyond crafted headers, correlate suspicious underscore-header requests with subsequent account activity, access to sensitive endpoints, failed or successful authorization attempts, and unusual redirect responses.

• X-Forwarded_For
• X-Forwarded_Proto
• X-Forwarded_Host
• X-Forwarded_Port
• X-Forwarded_Server
• X-Forwarded_Ssl
• X-Real_IP
• HTTP_X_FORWARDED_FOR
• HTTP_X_FORWARDED_PROTO
• HTTP_X_FORWARDED_HOST
• HTTP_X_FORWARDED_PORT
• HTTP_X_REAL_IP
• X-Forwarded_Proto: http
• X-Forwarded_Ssl: off
• X-Forwarded_Host:
• X-Forwarded_For: 127.0.0.1
• X-Forwarded_For: localhost
• X-Forwarded_For: 0.0.0.0

What your security team should do

• Inventory internet-facing and internal Ruby applications that use Puma behind reverse proxies, CDNs, ingress controllers, or load balancers.
• Prioritize patching applications where forwarded headers influence authentication, authorization, IP allowlists, redirect generation, URL generation, tenant routing, logging, fraud controls, or TLS enforcement.
• Upgrade Puma to a fixed version or source revision containing e867e53aa4e7df91fa97d8995a80fc2f9466a080 and redeploy all affected containers, hosts, and serverless images.
• Add proxy-layer controls to strip or reject client-supplied forwarding headers, especially underscore variants of trusted hyphenated headers.
• Search historical access logs for requests containing underscore forwarding headers and investigate matching sessions for suspicious redirects, source-IP spoofing, or unexpected HTTP scheme handling.
• Add regression tests that verify underscore header variants cannot override trusted proxy headers.
• Ensure applications trust forwarded headers only from known proxy addresses and do not use unvalidated header values for security-critical decisions.