PT-2019-1854 · Ruby On Rails+3 · Action View+3
Notoriousrebel
·
Published
2019-03-13
·
Updated
2025-09-29
·
CVE-2019-5418
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Action View versions prior to 5.2.2.1
Action View versions prior to 5.1.6.2
Action View versions prior to 5.0.7.2
Action View versions prior to 4.2.11.1
Action View version 3
Description
There is a File Content Disclosure issue in Action View where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed. This can be exploited by a remote attacker to read arbitrary files. The issue is related to errors in handling HTTP Accept headers when using the
render file handler in the code. The impact is limited to calls to render that render file contents without a specified accept format.Recommendations
For Action View versions prior to 5.2.2.1, upgrade to version 5.2.2.1 or later.
For Action View versions prior to 5.1.6.2, upgrade to version 5.1.6.2 or later.
For Action View versions prior to 5.0.7.2, upgrade to version 5.0.7.2 or later.
For Action View versions prior to 4.2.11.1, upgrade to version 4.2.11.1 or later.
For Action View version 3, consider applying a monkey patch in an initializer to mitigate the issue, such as the
formats filter.rb patch.
As a temporary workaround, consider specifying a format for file rendering, like render file: "#{Rails.root}/some/file", formats: [:html].Exploit
Fix
Path traversal
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Action View
Suse
Ubuntu