From 5e1d0c516b93b07b9295d39d33d83242185eb143 Mon Sep 17 00:00:00 2001
From: Al Snow <jasnow@hotmail.com>
Date: Sat, 2 Nov 2024 20:23:47 +0000
Subject: [PATCH] Updated advisory posts against
 rubysec/ruby-advisory-db@a30efc4

---
 .../_posts/2024-11-01-CVE-2024-21510.md       | 36 +++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 advisories/_posts/2024-11-01-CVE-2024-21510.md

diff --git a/advisories/_posts/2024-11-01-CVE-2024-21510.md b/advisories/_posts/2024-11-01-CVE-2024-21510.md
new file mode 100644
index 0000000..cc0c98e
--- /dev/null
+++ b/advisories/_posts/2024-11-01-CVE-2024-21510.md
@@ -0,0 +1,36 @@
+---
+layout: advisory
+title: 'CVE-2024-21510 (sinatra): Sinatra vulnerable to Reliance on Untrusted Inputs
+  in a Security Decision'
+comments: false
+categories:
+- sinatra
+advisory:
+  gem: sinatra
+  cve: 2024-21510
+  ghsa: hxx2-7vcw-mqr3
+  url: https://github.com/advisories/GHSA-hxx2-7vcw-mqr3
+  title: Sinatra vulnerable to Reliance on Untrusted Inputs in a Security Decision
+  date: 2024-11-01
+  description: |
+    Versions of the package sinatra from 0.0.0 are vulnerable to
+    Reliance on Untrusted Inputs in a Security Decision via the
+    X-Forwarded-Host (XFH) header.
+
+    When making a request to a method with redirect applied, it is
+    possible to trigger an Open Redirect Attack by inserting an
+    arbitrary address into this header. If used for caching purposes,
+    such as with servers like Nginx, or as a reverse proxy, without
+    handling the X-Forwarded-Host header, attackers can potentially
+    exploit Cache Poisoning or Routing-based SSRF.
+  cvss_v3: 5.4
+  notes: Never patched
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2024-21510
+    - https://security.snyk.io/vuln/SNYK-RUBY-SINATRA-6483832
+    - https://github.com/sinatra/sinatra/pull/2010
+    - https://github.com/sinatra/sinatra/blob/b626e2d82c23b4fde0b51782fd32ca27ccde1d1a/lib/sinatra/base.rb#L319
+    - https://github.com/sinatra/sinatra/blob/b626e2d82c23b4fde0b51782fd32ca27ccde1d1a/lib/sinatra/base.rb#L323C1-L343C17
+    - https://github.com/advisories/GHSA-hxx2-7vcw-mqr3
+---