GHSA-86g5-2wh3-gc9j

Suggest an improvement
Source
https://github.com/advisories/GHSA-86g5-2wh3-gc9j
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/03/GHSA-86g5-2wh3-gc9j/GHSA-86g5-2wh3-gc9j.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-86g5-2wh3-gc9j
Aliases
Published
2019-03-13T17:26:59Z
Modified
2024-02-15T05:34:00.922635Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Path Traversal in Action View
Details

File Content Disclosure in Action View

Impact

There is a possible file content disclosure vulnerability in Action View. Specially crafted accept headers in combination with calls to render file: can cause arbitrary files on the target server to be rendered, disclosing the file contents.

The impact is limited to calls to render which render file contents without a specified accept format. Impacted code in a controller looks something like this: 

class UserController < ApplicationController 
  def index 
    render file: "#{Rails.root}/some/file" 
  end 
end

Rendering templates as opposed to files is not impacted by this vulnerability.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases

The 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, and 4.2.11.1 releases are available at the normal locations.

Workarounds

This vulnerability can be mitigated by specifying a format for file rendering, like this: 

class UserController < ApplicationController 
  def index 
    render file: "#{Rails.root}/some/file", formats: [:html] 
  end 
end

In summary, impacted calls to render look like this: 

render file: "#{Rails.root}/some/file"

The vulnerability can be mitigated by changing to this: 

render file: "#{Rails.root}/some/file", formats: [:html]

Other calls to render are not impacted.

Alternatively, the following monkey patch can be applied in an initializer: 

$ cat config/initializers/formats_filter.rb 
# frozen_string_literal: true 

ActionDispatch::Request.prepend(Module.new do 
  def formats 
    super().select do |format| 
      format.symbol || format.ref == "*/*" 
    end 
  end 
end)

Credits

Thanks to John Hawthorn john@hawthorn.email of GitHub

References

Affected packages

RubyGems / actionview

Package

Name
actionview
Purl
pkg:gem/actionview

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.2.0
Fixed
5.2.2.1

Affected versions

5.*

5.2.0
5.2.1.rc1
5.2.1
5.2.1.1
5.2.2.rc1
5.2.2

Database specific 

{
    "last_known_affected_version_range": "<= 5.2.2.0"
}

RubyGems / actionview

Package

Name
actionview
Purl
pkg:gem/actionview

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
4.2.11.1

Affected versions

4.*

4.1.0.beta1
4.1.0.beta2
4.1.0.rc1
4.1.0.rc2
4.1.0
4.1.1
4.1.2.rc1
4.1.2.rc2
4.1.2.rc3
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6.rc1
4.1.6.rc2
4.1.6
4.1.7
4.1.7.1
4.1.8
4.1.9.rc1
4.1.9
4.1.10.rc1
4.1.10.rc2
4.1.10.rc3
4.1.10.rc4
4.1.10
4.1.11
4.1.12.rc1
4.1.12
4.1.13.rc1
4.1.13
4.1.14.rc1
4.1.14.rc2
4.1.14
4.1.14.1
4.1.14.2
4.1.15.rc1
4.1.15
4.1.16.rc1
4.1.16
4.2.0.beta1
4.2.0.beta2
4.2.0.beta3
4.2.0.beta4
4.2.0.rc1
4.2.0.rc2
4.2.0.rc3
4.2.0
4.2.1.rc1
4.2.1.rc2
4.2.1.rc3
4.2.1.rc4
4.2.1
4.2.2
4.2.3.rc1
4.2.3
4.2.4.rc1
4.2.4
4.2.5.rc1
4.2.5.rc2
4.2.5
4.2.5.1
4.2.5.2
4.2.6.rc1
4.2.6
4.2.7.rc1
4.2.7
4.2.7.1
4.2.8.rc1
4.2.8
4.2.9.rc1
4.2.9.rc2
4.2.9
4.2.10.rc1
4.2.10
4.2.11

Database specific 

{
    "last_known_affected_version_range": "<= 4.2.11.0"
}

RubyGems / actionview

Package

Name
actionview
Purl
pkg:gem/actionview

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.1.0
Fixed
5.1.6.2

Affected versions

5.*

5.1.0
5.1.1
5.1.2.rc1
5.1.2
5.1.3.rc1
5.1.3.rc2
5.1.3.rc3
5.1.3
5.1.4.rc1
5.1.4
5.1.5.rc1
5.1.5
5.1.6
5.1.6.1

Database specific 

{
    "last_known_affected_version_range": "<= 5.1.6.1"
}

RubyGems / actionview

Package

Name
actionview
Purl
pkg:gem/actionview

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.0.0
Fixed
5.0.7.2

Affected versions

5.*

5.0.0
5.0.0.1
5.0.1.rc1
5.0.1.rc2
5.0.1
5.0.2.rc1
5.0.2
5.0.3
5.0.4.rc1
5.0.4
5.0.5.rc1
5.0.5.rc2
5.0.5
5.0.6.rc1
5.0.6
5.0.7
5.0.7.1

Database specific 

{
    "last_known_affected_version_range": "<= 5.0.7.1"
}