oss-security - [AMENDED] [CVE-2014-0130] Ruby on Rails: Directory Traversal Vulnerability With Certain Route Configurations

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAC9YFzdizSKH=8+Nu-BZ72d9boyRtOi+FbRBRjtz2ab7w9gR0g@mail.gmail.com>
Date: Tue, 6 May 2014 19:50:00 -0300
From: Rafael Mendonça França <rafaelmfranca@...il.com>
To: oss-security@...ts.openwall.com
Subject: [AMENDED] [CVE-2014-0130] Ruby on Rails: Directory Traversal
 Vulnerability With Certain Route Configurations

An earlier version of this advisory incorrectly assumed that the only way
to trigger this vulnerability was with routes containing '*action'.  There
are additional attack vectors and as a result *all* users are advised to
upgrade to a fixed version as soon as possible.

There is a vulnerability in the 'implicit render' functionality in Ruby on
Rails. This vulnerability has been assigned the CVE identifier
CVE-2014-0130.

Versions Affected:  All Supported
Not affected:       None
Fixed Versions:     4.1.1, 4.0.5, 3.2.18

Impact
------
The implicit render functionality allows controllers to render a template,
even if there is no explicit action with the corresponding name.  This
module does not perform adequate input sanitization which could allow an
attacker to use a specially crafted request to retrieve arbitrary files
from the rails application server.

Releases
--------
The 4.1.1, 4.0.5 & 3.2.18 releases are available at the normal locations.

Workarounds
-----------

There are no feasible work arounds for this issue.

If your application depends on this functionality, you will need to rename
the route parameter and add an explicit action:

  get 'my_url/*template_path', controller: 'asdf', action: 'display'

Then add an action which renders explicitly:

  def display
    if !params[:template_path].index('.')
      render file: params[:template_path]
    end
  end

Note: The path check in this example may not be suitable for your
application, take care.

Patches
-------
To aid users who aren't able to upgrade immediately we have provided
patches for the two supported release series.  They are in git-am format
and consist of a single changeset.

* 4-1-directory_traversal.patch - Patch for 4.1 series
* 4-0-directory_traversal.patch - Patch for 4.0 series
* 3-2-directory_traversal.patch - Patch for 3.2 series

Please note that only the 4.1.x, 4.0.x and 3.2.x series are supported at
present.  Users of earlier unsupported releases are advised to upgrade as
soon as possible as we cannot guarantee the continued availability of
security fixes for unsupported releases.

Credits
-------
Thanks to Ville Lautanala of Flowdock for reporting the vulnerability to
us, and working with us on a fix. Additional thanks to Tobias Kraze and
Thomas Eisenbarth of makandra for correcting our earlier error.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.