PT-2018-13599 · Google · Active Storage

Rafael Mendonça França · Published 2018-11-30 · Updated 2019-10-09 · CVE-2018-16477

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Active Storage versions 5.2.0 through 5.2.1.0

Description A bypass issue in Active Storage for Google Cloud Storage and Disk services allows an attacker to modify the content-disposition and content-type parameters, potentially executing HTML files inline. This can be combined with techniques like cookie bombing and specially crafted AppCache manifests to access private signed URLs within a specific storage path. Vulnerable applications are those using either GCS or the Disk service in production.

Recommendations For Active Storage versions 5.2.0 through 5.2.1.0, update to version 5.2.1.1 to resolve the issue. As a temporary workaround, consider restricting access to the content-disposition and content-type parameters until a patch is available.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-16477

GHSA-7RR7-RCJW-56VJ

OPENSUSE-SU-2024:11328-1

OPENSUSE-SU-2024:11347-1

Affected Products

Active Storage

References · 9

• 🔥 https://groups.google.com/d/msg/rubyonrails-security/3KQRnXDIuLg/mByx5KkqBAAJ · Exploit
• https://weblog.rubyonrails.org/2018/11/27/Rails-4-2-5-0-5-1-5-2-have-been-released · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-16477 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-16477 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-16477 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-16477 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7rr7-rcjw-56vj · Vendor Advisory
• https://github.com/advisories/GHSA-7rr7-rcjw-56vj · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16477 · Note