Path traversal in Rack CORS Middleware - CVE-2019-18978

Vulnerability identifier: #VU25103

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-18978

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to resource matching does not ensure that pathnames are in a canonical format when processing directory traversal sequences. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.

Rack CORS Middleware
ruby-rack-cors (Debian package)
ruby-rack-cors (Ubuntu package)
rubygem-rack-cors
Gitlab Community Edition
Fedora
Ubuntu

Install update from vendor's website.

Rack CORS Middleware - update to 1.0.4
ruby-rack-cors (Debian package) - update to 1.0.2-1+deb10u1
Gitlab Community Edition - addressed in versions 12.5.9, 12.6.6, 12.7.4
ruby-rack-cors (Ubuntu package) - update to 0.4.0-1+deb9u2build0.16.04.1
rubygem-rack-cors - update to 1.0.6-1.el7

• https://github.com/cyu/rack-cors/commit/e4d4fc362a4315808927011cbe5afcfe5486f17d
• https://github.com/cyu/rack-cors/compare/v1.0.3...v1.0.4
• https://lists.debian.org/debian-lts-announce/2020/02/msg00004.html

• Path traversal in Rack CORS Middleware gem for Ruby
• Multiple vulnerabilities in Gitlab Community Edition
• Debian update for ruby-rack-cors
• Fedora EPEL 7 update for rubygem-rack-cors
• Ubuntu update for ruby-rack-cors