Debian Security Advisory DSA-6542-1: Rack-Session Vulnerability — Patching, Detection, and Hardening Guide for Ruby Web Stacks

---
title: Ruby Rack Application Spawning Shell or System Commands
id: 3f8a2c1e-7b4d-4e9a-b2c6-8d1e5f7a9034
status: experimental
description: Detects Ruby/Rack web application processes spawning shells or common post-exploitation binaries, consistent with RCE via session middleware or deserialization abuse in ruby-rack-session (DSA-6542-1).
references:
  - https://security-tracker.debian.org/tracker/DSA-6542-1
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
      - '/ruby'
      - 'puma'
      - 'unicorn'
      - 'passenger'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
      - '/base64'
      - '/id'
  condition: selection_parent and selection_child
falsepositives:
  - Application frameworks that legitimately shell out for image processing (e.g., ImageMagick wrappers) — tune by ParentCommandLine
  - Deployment hooks running under the app user
level: high
---
title: Suspicious Session Cookie Fixation Pattern in Web Access Logs
id: 6c1d4e92-5a7f-4b38-9d2e-1f3a6b8c0547
status: experimental
description: Detects repeated requests from a single source presenting identical session identifiers across distinct authentication contexts, or session IDs in URL query parameters — indicators of session fixation attempts against Rack-based applications (DSA-6542-1).
references:
  - https://security-tracker.debian.org/tracker/DSA-6542-1
  - https://attack.mitre.org/techniques/T1563/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.initial_access
  - attack.t1563
logsource:
  category: webserver
  product: linux
detection:
  selection_session_param:
    cs-uri-query|contains:
      - 'session_id='
      - '_session_id='
      - 'rack.session='
      - 'PHPSESSID='
  selection_encoded:
    cs-uri-query|contains:
      - '%5Fsession%5Fid'
  condition: 1 of selection_*
falsepositives:
  - Legacy applications that legitimately pass session tokens in query strings — confirm architecture before deploying broadly
level: medium
---
title: Direct Modification of Rack Session Store Files
id: 9e5b7f31-2c8a-4d16-a3e9-7f4c2b6d1852
status: experimental
description: Detects write or delete activity against file-based Rack/Rails session store directories by processes other than the application runtime, indicating session tampering or theft consistent with ruby-rack-session abuse (DSA-6542-1).
references:
  - https://security-tracker.debian.org/tracker/DSA-6542-1
  - https://attack.mitre.org/techniques/T1539/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.credential_access
  - attack.t1539
  - attack.t1078
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/tmp/sessions/'
      - '/tmp/session_store'
      - '/rack.session'
      - '/tmp/cache/sessions/'
  filter_app:
    Image|contains:
      - '/ruby'
      - 'puma'
      - 'unicorn'
  condition: selection_path and not filter_app
falsepositives:
  - Session cleanup cron jobs (expire stale sessions) — allowlist the maintenance script path
  - Backup agents
level: high

// Hunt 1: Ruby/Rack app processes spawning shells or downloaders (post-exploitation of session middleware flaw)
// Works with Sysmon for Linux, Auditd via AMA, or Defender for Endpoint Linux telemetry
union isfuzzy=true
(DeviceProcessEvents
| where InitiatingProcessFileName has_any ("ruby", "puma", "unicorn", "passenger")
| where FileName has_any ("bash", "sh", "dash", "curl", "wget", "nc", "ncat", "python3", "base64")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName),
(Syslog
| where ProcessName has_any ("ruby", "puma", "unicorn", "passenger")
| where SyslogMessage has_any ("/bin/bash", "/bin/sh", "curl ", "wget ", "nc -", "python3 -c")
| project TimeGenerated, Computer, ProcessName, SyslogMessage)
| order by TimeGenerated desc;

// Hunt 2: Session identifiers passed in URL query strings — session fixation precursor against Rack apps
CommonSecurityLog
| where RequestURL has_any ("session_id=", "_session_id=", "rack.session=")
| summarize RequestCount = count(), DistinctCookies = dcount(RequestClientApplication) by SourceIP, RequestURL, bin(TimeGenerated, 1h)
| where RequestCount > 20
| order by RequestCount desc;

// Hunt 3: Single source IP authenticating with many distinct session cookies — session brute-force/guessing signal
Syslog
| where SyslogMessage has ("rack.session")
| extend SessionCookie = extract(@"rack\.session=([A-Za-z0-9%\-_.]+)", 1, SyslogMessage)
| where isnotempty(SessionCookie)
| summarize DistinctSessions = dcount(SessionCookie), TotalRequests = count() by Computer, SourceIP = HostIP, bin(TimeGenerated, 15m)
| where DistinctSessions > 50
| order by DistinctSessions desc;

-- DSA-6542-1 triage: identify ruby-rack-session installations and suspicious Ruby process behavior
-- Hunt 1: Enumerate installed ruby-rack-session package versions (Debian/Ubuntu hosts)
SELECT Hostname,
       Fqdn,
       read_file(filename='/var/lib/dpkg/status') AS DpkgStatus
FROM clients()
LIMIT 1;

-- Per-host package check (run as a hunt across the fleet)
SELECT split(string=line, sep=' ') AS Fields
FROM parse_lines(filename='/var/lib/dpkg/status')
WHERE line =~ 'ruby-rack-session';

-- Hunt 2: Ruby web processes with shell children or outbound connections to rare destinations
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)ruby|puma|unicorn|passenger'
   OR CommandLine =~ '(?i)rack';

-- Hunt 3: Network listeners held by Ruby processes — baseline before patching, alert on new ones after
SELECT Pid, Name, LocalAddress, LocalPort, RemoteAddress, RemotePort, State
FROM netstat()
WHERE Name =~ '(?i)ruby|puma|unicorn|passenger'
  AND State = 'LISTEN';

#!/usr/bin/env bash
# DSA-6542-1 ruby-rack-session remediation & verification
# Run as root or via sudo

set -euo pipefail

echo "=== [1/4] Checking if ruby-rack-session is installed ==="
if ! dpkg -l ruby-rack-session 2>/dev/null | grep -q '^ii'; then
    echo "[*] ruby-rack-session not installed via apt."
    echo "[!] REMINDER: check Gemfile.lock for vendored rack-session gems — apt will not patch bundler-managed installs:"
    echo "      find / -name 'Gemfile.lock' -exec grep -l 'rack-session' {} \; 2>/dev/null"
    exit 0
fi

CURRENT=$(dpkg-query -W -f='${Version}' ruby-rack-session)
echo "[*] Installed version: ${CURRENT}"

echo "=== [2/4] Applying DSA-6542-1 update ==="
apt-get update -qq
apt-get install --only-upgrade -y ruby-rack-session

NEW=$(dpkg-query -W -f='${Version}' ruby-rack-session)
echo "[*] Version after update: ${NEW}"

echo "=== [3/4] Verifying against Debian security tracker ==="
# Confirm the installed version matches or exceeds the fixed version listed in DSA-6542-1
# Cross-reference: https://security-tracker.debian.org/tracker/DSA-6542-1
dpkg --compare-versions "${NEW}" gt "${CURRENT}" \
  && echo "[+] Package upgraded successfully" \
  || echo "[!] WARNING: version unchanged — check apt sources include the security repo (deb http://security.debian.org/debian-security <release>-security main)"

echo "=== [4/4] Restarting affected Ruby services ==="
# Rack middleware is loaded in-process; the app MUST be restarted for the patch to take effect
for svc in $(systemctl list-units --type=service --state=running --no-legend | awk '{print $1}' | grep -Ei 'puma|unicorn|passenger|rails|redmine|foreman'); do
    echo "[*] Restarting ${svc}"
    systemctl restart "${svc}"
done

echo "[+] Done. Verify application health post-restart and confirm no stale gem-vendored copies remain."