PT-2019-1854 · Ruby On Rails+3 · Action View+3
Notoriousrebel
·
Publicado
2019-03-13
·
Atualizado
2025-09-29
·
CVE-2019-5418
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Action View versions prior to 5.2.2.1
Action View versions prior to 5.1.6.2
Action View versions prior to 5.0.7.2
Action View versions prior to 4.2.11.1
Action View version 3
Description
There is a File Content Disclosure issue in Action View where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed. This can be exploited by a remote attacker to read arbitrary files. The issue is related to errors in handling HTTP Accept headers when using the
render file handler in the code. The impact is limited to calls to render that render file contents without a specified accept format.Recommendations
For Action View versions prior to 5.2.2.1, upgrade to version 5.2.2.1 or later.
For Action View versions prior to 5.1.6.2, upgrade to version 5.1.6.2 or later.
For Action View versions prior to 5.0.7.2, upgrade to version 5.0.7.2 or later.
For Action View versions prior to 4.2.11.1, upgrade to version 4.2.11.1 or later.
For Action View version 3, consider applying a monkey patch in an initializer to mitigate the issue, such as the
formats filter.rb patch.
As a temporary workaround, consider specifying a format for file rendering, like render file: "#{Rails.root}/some/file", formats: [:html].Exploit
Correção
Path traversal
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Action View
Suse
Ubuntu