Authentication Credential Leakage in URI Gem for Ruby
Summary
CVE-2025-27221: In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host. Affects ruby2.7 across 2 version ranges.
< 2.7.4-1+deb11u5
< c13dfc2164bc4af31085e709ab348fdbd527013f
Fixed in 2.7.4-1+deb11u5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The URI gem is a crucial component of Ruby, providing methods for handling Uniform Resource Identifiers (URIs). It allows developers to construct, parse, and manipulate URIs effectively. However, prior to version 1.0.3, the gem exhibited a significant vulnerability that could lead to the unintended exposure of authentication credentials, particularly when changing hosts.
Vulnerability Detail
In the URI gem versions before 1.0.3, methods such as URI.join, URI#merge, and URI#+ inadvertently retained user authentication information even after the host was modified. This flaw could allow malicious actors to exploit the retained credentials, leading to unauthorized access and potential data breaches. The vulnerability stems from improper handling of userinfo in the URI processing methods, which fails to clear sensitive information when the host changes.
How To Fix
Minimum fixed version
2.7.4-1+deb11u5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade ruby2.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the affected methods (URI.join, URI#merge, URI#+) until you can update to the patched version. Instead, manually handle URI construction and merging without relying on these methods to prevent accidental leakage of authentication credentials.
Conclusion
The URI gem vulnerability (CVE-2025-27221) poses a significant risk by leaking authentication credentials due to improper handling of userinfo. It is crucial to update to version 1.0.3 or later to safeguard your application. Implementing workarounds and utilizing tools like Vulert can further enhance your security posture.
See every vulnerability recorded for ruby2.7 →
FAQ
The URI gem is a Ruby library that provides functionality for parsing and manipulating Uniform Resource Identifiers (URIs).
If your application uses the affected methods in the URI gem, it may unintentionally expose authentication credentials, leading to security risks.
If an immediate update is not possible, avoid using the vulnerable methods and implement manual URI handling as a temporary measure.
You can find detailed information about this vulnerability on the official CVE database or security advisories related to the URI gem.
Vulert allows you to monitor and alert for open-source vulnerabilities in your software using just a manifest file like package-lock.json, providing real-time insights without requiring code access.
Related vulnerabilities
Recent vulnerabilities recorded for ruby2.7.
