cbcvebase.
CVE-2016-0752
published 2016-02-16

CVE-2016-0752: Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before…

PriorityP186high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2022-04-15
Exploited in the wild
EPSS
95.54%
99.9th percentile
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.

Affected

57 ranges· showing 25
VendorProductVersion rangeFixed in
actionpack_projectactionpack>= 0 < 3.2.22.13.2.22.1
actionpack_projectactionpack>= 3.0.0 < 3.2.22.23.2.22.2
actionpack_projectactionpack>= 4.0.0 < 4.1.14.14.1.14.1
actionpack_projectactionpack>= 4.0.0 < 4.1.14.24.1.14.2
actionpack_projectactionpack>= 4.2.0 < 4.2.5.14.2.5.1
debiandebian_linux
debianrails< rails 2:4.2.5.2-1 (bookworm)rails 2:4.2.5.2-1 (bookworm)
debianrails< rails 2:4.2.5.1-1 (bookworm)rails 2:4.2.5.1-1 (bookworm)
opensuseleap
opensuseopensuse
railsactionview>= 3.0.0 < 3.2.22.23.2.22.2
railsactionview>= 3.2.0 < 3.2.22.23.2.22.2
railsactionview>= 4.0.0 < 4.1.14.14.1.14.1
railsactionview>= 4.0.0 < 4.1.14.24.1.14.2
railsactionview>= 4.2.0 < 4.2.5.14.2.5.1
redhatsoftware_collections
rubyonrailsrails< 3.2.22.13.2.22.1
rubyonrailsrails
rubyonrailsrails
rubyonrailsrails
rubyonrailsrails
rubyonrailsrails
rubyonrailsrails
rubyonrailsrails
rubyonrailsrails

Detection & IOCsextracted from sources · hover to see the quote

urlURIPATH/%2f
urlURIPATH/%2fproc%2fself%2fcomm
urlURIPATH/proc%2fself%2ffd%2f7
port3000
path/proc/self/fd/7
path/proc/self/comm
  • Detect directory traversal attempts against Rails Action View render by looking for URL-encoded path separators (%2f) combined with path traversal sequences (.. or /proc/self/) in GET requests to application endpoints.
  • Monitor for multipart/form-data POST requests uploading .gif files followed immediately by a GET request referencing a /tmp/ path or Tempfile path — this is the TempFile upload + inclusion attack pattern for CVE-2016-0752 RCE.
  • Alert on HTTP responses containing 'Tempfile:/<path>' in the body, which leaks the temporary file path used for the inclusion/RCE step.
  • Detect exploitation attempts reading /proc/self/fd/7 via URL-encoded traversal (proc%2fself%2ffd%2f7) to leak Rails log file contents containing Tempfile paths, bypassing extension checks.
  • Flag Rails applications where the render method is called with unsanitized user-controlled parameters (e.g., render params[:id]), as this is the prerequisite vulnerable code pattern for CVE-2016-0752.
  • Check HTTP responses for the string 'render params' in the body (dev environment error pages), which confirms a dynamically vulnerable render endpoint.
  • Check HTTP responses for the string 'ruby' when requesting /proc/self/comm via traversal — a positive match indicates arbitrary file read is confirmed on the target.
  • ·The Metasploit module default URIPATH is '/users' — actual vulnerable path varies per application; operators must enumerate the correct dynamic render endpoint before exploitation.
  • ·The module only supports linux and bsd platforms with x86 architecture for the payload stage; the directory traversal/file read primitive itself is platform-agnostic.
  • ·The log inclusion fallback (leak_log via /proc/self/fd/7) is used only when the Tempfile path cannot be extracted from the 422 response body directly.
  • ·Only one exploitation attempt is possible when testing against the built-in Rails WEBrick server; repeated attempts will fail.
  • ·CVE-2016-2097 is a bypass of the incomplete fix for CVE-2016-0752; detections and patches for CVE-2016-0752 alone are insufficient — both must be addressed.

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
ghsa7.5HIGH
osv7.5HIGH
vulncheck7.5HIGH
cisa7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.