Path traversal in Action Mailer - CVE-2014-7819

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.

Affected software

How to mitigate CVE-2014-7819

External References

• http://lists.opensuse.org/opensuse-updates/2014-11/msg00103.html
• http://lists.opensuse.org/opensuse-updates/2014-11/msg00105.html
• http://lists.opensuse.org/opensuse-updates/2014-11/msg00110.html
• http://lists.opensuse.org/opensuse-updates/2014-11/msg00111.html
• https://groups.google.com/forum/message/raw?msg=rubyonrails-security/doAVp0YaTqY/aHFngBqNBoAJ
• https://groups.google.com/forum/message/raw?msg=rubyonrails-security/wQBeGXqGs3E/JqUMB6fhh3gJ

Related Security Bulletins

• Path traversal in Rails Action Mailer for Ruby on Rails
• Path traversal in ruby-redmine-actionmailer (Alpine package)
• Path traversal in ruby-actionmailer (Alpine package)
• Fedora 21 update for rubygem-sprockets