Path traversal in Ruby on Rails - CVE-2016-0752

Vulnerability identifier: #VU8568

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-0752

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a remote attacker to read arbitrary files on the system.

The vulnerability exists due to improper input validation in Action View. A remote attacker can send a specially crafted request, containing directory traversal sequences (e.g. "../") and view contents of arbitrary file on vulnerable system.

Ruby on Rails
Debian Linux
Fedora
rubygem-activemodel
rubygem-actionview
rubygem-actionpack

Update to version 3.2.22.1, 4.1.14.1 or 4.2.5.1.

rubygem-activemodel - update to 4.2.0-2.fc22
rubygem-actionview - addressed in versions 4.2.0-3.fc22, 4.2.3-3.fc23
rubygem-actionpack - update to 4.2.0-3.fc22

• Exploit #1330 - Ruby on Rails - Dynamic Render File Upload / Remote Code Execution (Metasploit) (March 18, 2020)
• Exploit #1760 - Ruby on Rails Dynamic Render File Upload Remote Code Execution (March 18, 2020)

• https://groups.google.com/forum/message/raw?msg=ruby-security-ann/335P1DcLG00/JXcBnTtZEgAJ

• Directory traversal in Ruby on Rails
• Debian update for rails
• SUSE Linux update for portus
• Fedora 23 update for rubygem-actionview
• Fedora 22 update for rubygem-actionview
• Fedora 22 update for rubygem-actionpack, rubygem-activemodel