oss-security - Re: [AMENDED] [CVE-2014-0130] Ruby on Rails: Directory Traversal Vulnerability With Certain Route Configurations

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAMPmzRsSsA95R_xUeRSristeC3KwFR_qyBMhWy2Rss=kHy9ZsQ@mail.gmail.com>
Date: Wed, 7 May 2014 11:53:12 -0500
From: Jacob Kaplan-Moss <jacob@...oku.com>
To: oss-security@...ts.openwall.com, 
	Rafael Mendonça França <rafaelmfranca@...il.com>
Cc: "security@...oku.com" <security@...oku.com>
Subject: Re: [AMENDED] [CVE-2014-0130] Ruby on Rails: Directory
 Traversal Vulnerability With Certain Route Configurations

Hey Rafael -

On Tue, May 6, 2014 at 5:50 PM, Rafael Mendonça França <
rafaelmfranca@...il.com> wrote:

> An earlier version of this advisory incorrectly assumed that the only way
> to trigger this vulnerability was with routes containing '*action'.  There
> are additional attack vectors and as a result *all* users are advised to
> upgrade to a fixed version as soon as possible.
>

Can you clarify what these "additional attack vectors" are? We've been
looking at this closely here at Heroku, and as far as we can tell it's only
the original vector (*action/:action). What are we missing here?

We'd like to be better able to evaluate if we're vulnerable -- and, more
importantly, we'd like to understand if this is a big enough deal for us to
notify our customers and directly encourage them to upgrade (a step we've
taken in the past). However, without more details about these "additional
vectors" we're kinda shooting in the dark. Can you share more details?

Thanks!

Jacob Kaplan-Moss
Director of Security, Heroku

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.