Sinatra Dependency Vulnerability (CVE-2024-21510) #1908

Activity

1. mightystrong

   changed the title [-]Sinatra Dependency Vulnerability [/-] [+]Sinatra Dependency Vulnerability (CVE-2024-21510)[/+] on Nov 7, 2024
2. bermannoah commented on Nov 22, 2024

   

   bermannoah

   on Nov 22, 2024

   More actions

   It looks like there's a patch out but the maintainer has no plans to backport it to 3.X. I might try and have a look at what the update would do but I haven't contributed to or worked on this codebase before; has anybody else got a fix in the works?
3. jeromecornet commented on Dec 29, 2024

   

   jeromecornet

   on Dec 29, 2024

   Last edited by jeromecornet

   More actions

   I figured I'd share a monkey-patch while waiting for a proper fix for this:

   I am using (for now) the following monkey-patch in my rails app (in config/initializers/sinatra.rb)

   Rails.application.config.after_initialize do
     require "sinatra/base"
     class Sinatra::Base
       set :host_authorization, permitted_hosts: Rails.application.config.hosts.map(&:to_s)
     end
   end

   This sets the proper config by default on all Sinatra apps mounted as engines (including resque-web) to the same list as the Rails authorized hosts list, so it lets you upgrade to Sinatra to 4.1.0 or later.

   The proper way to fix this would be to add this sinatra config when the engine gets mounted, but I'm using several unpatched engines that rely on Sinatra so this was a quicker fix.
4. tobyond commented on Feb 28, 2025

   

   tobyond

   on Feb 28, 2025

   More actions

   Thanks for the monkey-patch, @jeromecornet it worked perfectly! I was getting a "Host not permitted" error when accessing the Resque web UI via a custom domain (e.g., myapp.local:3000/admin/resque), but localhost:3000/admin/resque worked fine. Appreciate the fix!
5. FangjianLu commented on Sep 25, 2025

   

   FangjianLu

   on Sep 25, 2025

   More actions

   For non Rails app, I managed to get it work by adding below before calling Resque::Server.new in config.ru

   Resque::Server.set :host_authorization, {permitted_hosts: []}
   
6. zzak commented on Nov 25, 2025

   

   zzak

   on Nov 25, 2025

   Contributor

   More actions

   This can be closed too
7. mikevoets commented on Mar 2, 2026

   

   mikevoets

   on Mar 2, 2026

   More actions

   Can we expect a fix or compatibility with Sinatra 4.x at some point, or shall we simply apply the monkey-patch?