Ruby on Rails 'implicit render' Functionality Directory Traversal Vulnerability
BID:67244
Info
Ruby on Rails 'implicit render' Functionality Directory Traversal Vulnerability
| Bugtraq ID: | 67244 |
| Class: | Input Validation Error |
| CVE: |
CVE-2014-0130 |
| Remote: | Yes |
| Local: | No |
| Published: | May 06 2014 12:00AM |
| Updated: | Jul 15 2015 12:32AM |
| Credit: | Ville Lautanala of Flowdock |
| Vulnerable: |
Ruby on Rails Ruby on Rails 3.2.4 Ruby on Rails Ruby on Rails 3.2.2 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 |
| Not Vulnerable: | |
Discussion
Ruby on Rails 'implicit render' Functionality Directory Traversal Vulnerability
Ruby on Rails is prone to a directory-traversal vulnerability.
A remote attacker could exploit the vulnerability using directory-traversal characters ('../') to access arbitrary files that contain sensitive information.
Ruby on Rails is prone to a directory-traversal vulnerability.
A remote attacker could exploit the vulnerability using directory-traversal characters ('../') to access arbitrary files that contain sensitive information.
Exploit / POC
Ruby on Rails 'implicit render' Functionality Directory Traversal Vulnerability
An attacker can use readily available tools to exploit this issue.
An attacker can use readily available tools to exploit this issue.
Solution / Fix
Ruby on Rails 'implicit render' Functionality Directory Traversal Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Ruby on Rails 'implicit render' Functionality Directory Traversal Vulnerability
References:
References: