Arbitrary file existence disclosure in Action Pack

2014-11-1621:00:00

RubySec

rubysec.com

Specially crafted requests can be used to determine whether a file exists on
the filesystem that is outside the Rails application’s root directory. The
files will not be served, but attackers can determine whether or not the file
exists. This vulnerability is very similar to CVE-2014-7818, but the
specially crafted string is slightly different.

CPENameOperatorVersion
actionpacklt3.0.0
actionpackle3.2.20
actionpackge3.3.0
actionpackle4.0.11.0
actionpackge4.0.12.0
actionpackle4.0.11
actionpackge4.1.0
actionpackle4.1.7.0
actionpackge4.1.8.0
actionpacklt4.1.8

Name	Operator	Version
actionpack	lt	3.0.0
actionpack	le	3.2.20
actionpack	ge	3.3.0
actionpack	le	4.0.11.0
actionpack	ge	4.0.12.0
actionpack	le	4.0.11
actionpack	ge	4.1.0
actionpack	le	4.1.7.0
actionpack	ge	4.1.8.0
actionpack	lt	4.1.8

References

groups.google.com/forum/#!topic/rubyonrails-security/rMTQy4oRCGk

JSON

Related for RUBY:ACTIONPACK-2014-7829