# Escape sequence injection vulnerability in WEBrick BasicAuth

WEBrick BasicAuth logs unsanitized usernames, letting an attacker inject ANSI escape sequences that alter the terminal window title of the server operator.

- Payout: hidden
- Severity: medium
- Program: Ruby
- Found by: mame
- Disclosed: 2017-09-15
- CVE: CVE-2017-10784
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/223363
- Library page: https://bugbountylibrary.com/r/h1%3A223363
- Tags: area:oss domain:oss impact:integrity kind:bounty platform:hackerone sev:medium tech:ruby technique:regression vuln:crlf-injection vuln:info-disclosure

**Target:** WEBrick HTTPAuth BasicAuth logging
**Root cause:** BasicAuth logs the supplied username on auth failure without stripping terminal escape sequences, so attacker-controlled bytes reach the operator's terminal.
**Steps:**
1. Run a WEBrick server mounting BasicAuth with an Htpasswd user DB on port 34567.
2. Send a request with basic auth username containing `\e]2;BOOM!\a` and any password.
3. Observe the server terminal log line and its window title changed to `BOOM!`.
**How found:** Researcher recognized the same class as the previously fixed 2010 WEBrick escape sequence injection and checked whether BasicAuth's failure logging still emitted raw usernames.
**Exploitation:** Attacker sends an HTTP request with a crafted Basic auth username; on failed auth the server logs the raw username, and the embedded OSC escape sequence rewrites the terminal window title of whoever views the log.
**Insight:** Any log sink that echoes attacker-controlled strings to a terminal (auth failures, 404 paths, headers) is an escape-sequence injection surface; check old fixed bug classes for regressions in sibling code paths.