cbcvebase.
CVE-2014-0130
published 2014-05-07

CVE-2014-0130: Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x…

PriorityP183high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
KEVITW
CISA Known Exploited Vulnerabilitydue 2022-04-15
Exploited in the wild
EPSS
53.70%
98.9th percentile
Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.

Affected

10 ranges
VendorProductVersion rangeFixed in
actionpack_projectactionpack>= 3.0.0 < 3.2.183.2.18
actionpack_projectactionpack>= 4.0.0 < 4.0.54.0.5
actionpack_projectactionpack>= 4.1.0 < 4.1.14.1.1
redhatenterprise_linux_server
redhatsubscription_asset_manager<= 1.3.0
rubyonrailsrails< 3.2.183.2.18
rubyonrailsrails>= 0 < 2:4.2.6-12:4.2.6-1
rubyonrailsrails>= 0 < 2:4.2.10-0ubuntu42:4.2.10-0ubuntu4
rubyonrailsrails>= 4.0.0 < 4.0.54.0.5
rubyonrailsrails>= 4.1.0 < 4.1.14.1.1

Detection & IOCsextracted from sources · hover to see the quote

  • Vulnerability exists in actionpack/lib/abstract_controller/base.rb — the implicit-render implementation fails to sanitize route wildcard/glob parameters, allowing directory traversal via crafted HTTP requests when route globbing is enabled.
  • Attack vector is a specially crafted HTTP request exploiting wildcard route segments (e.g. '*action' or similar glob patterns) to traverse directories and read arbitrary files from the Rails application server.
  • An earlier, narrower understanding of the attack surface was '*action' route globs only; the full scope includes additional attack vectors beyond routes containing '*action' — all route glob configurations should be treated as potentially vulnerable.
  • The implicit render functionality is the specific Rails code path to monitor/block; it renders templates without an explicit action and without adequate input sanitization of the route parameter.
  • ·Vulnerability is only triggerable when route globbing configurations are enabled in the Rails application. Applications without wildcard/glob route segments are at reduced (but not zero, per updated advisory) risk.
  • ·There are no feasible workarounds; the only reliable mitigation is upgrading to fixed versions (3.2.18, 4.0.5, or 4.1.1). A partial workaround requiring explicit actions and path checks is application-specific and may not be suitable for all apps.
  • ·Several Red Hat products (ruby193-rubygem-actionpack on OpenShift Enterprise 1, Red Hat OpenStack Platform 3 and 4) are marked 'Will not fix', meaning patched packages may not be available for those platforms.

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
osv7.5HIGH
vulncheck7.5HIGH
cisa7.5HIGH
vendor_redhat7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.