GHSA-86g5-2wh3-gc9j

Опубликовано: 13 мар. 2019

Источник: github

Github: Прошло ревью

CVSS3: 7.5

Описание

Path Traversal in Action View

File Content Disclosure in Action View

Impact

There is a possible file content disclosure vulnerability in Action View. Specially crafted accept headers in combination with calls to render file: can cause arbitrary files on the target server to be rendered, disclosing the file contents.

The impact is limited to calls to render which render file contents without a specified accept format. Impacted code in a controller looks something like this:

class UserController < ApplicationController def index render file: "#{Rails.root}/some/file" end end

Rendering templates as opposed to files is not impacted by this vulnerability.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases

The 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, and 4.2.11.1 releases are available at the normal locations.

Workarounds

This vulnerability can be mitigated by specifying a format for file rendering, like this:

class UserController < ApplicationController def index render file: "#{Rails.root}/some/file", formats: [:html] end end

In summary, impacted calls to render look like this:

render file: "#{Rails.root}/some/file"

The vulnerability can be mitigated by changing to this:

render file: "#{Rails.root}/some/file", formats: [:html]

Other calls to render are not impacted.

Alternatively, the following monkey patch can be applied in an initializer:

$ cat config/initializers/formats_filter.rb # frozen_string_literal: true ActionDispatch::Request.prepend(Module.new do def formats super().select do |format| format.symbol || format.ref == "*/*" end end end)

Credits

Thanks to John Hawthorn john@hawthorn.email of GitHub

Ссылки

Пакеты

Наименование

actionview

rubygems

Затронутые версииВерсия исправления

>= 5.2.0, <= 5.2.2.0

5.2.2.1

Наименование

actionview

rubygems

Затронутые версииВерсия исправления

>= 4.0.0, <= 4.2.11.0

4.2.11.1

Наименование

actionview

rubygems

Затронутые версииВерсия исправления

>= 5.1.0, <= 5.1.6.1

5.1.6.2

Наименование

actionview

rubygems

Затронутые версииВерсия исправления

>= 5.0.0, <= 5.0.7.1

5.0.7.2

EPSS

Процентиль: 100%

0.94336

Критический

7.5 High

CVSS3

CVE ID

CVE-2019-5418

Дефекты

CWE-22

Связанные уязвимости

CVE-2019-5418

CVSS3: 7.5

ubuntu

почти 7 лет назад

There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.