Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2018-3760 — Path Traversal in Project Sprockets

CWE-22 — Path TraversalCWE-200 — Sensitive Information Exposure12 documents10 sources
Severity
7.5HIGHNVD
EPSS
93.8%
top 0.14%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
5
Sprockets Project SprocketsHackerone SprocketsDebian Linux+2 more
Timeline
PublishedJun 26
Latest updateJul 19

Description

There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶RubyGemssprockets_project/sprockets3.0.0 — 3.7.2+2
▶NVDsprockets_project/sprockets2.0.0 — 2.12.4+2
▶CVEListV5hackerone/sprockets4.0.0.beta8, 3.7.2, 2.12.5
▶NVDredhat/cloudforms4.5, 4.6+1

Also affects: Debian Linux 9.0, Enterprise Linux 6.0, 6.7, 7.0, 7.3, 7.4, 7.5, 7.6

Patches

Patch: groups.google.com ↗Patch: groups.google.com ↗

🔴Vulnerability Details

5
CVEList
CVE-2018-3760: There is an information leak vulnerability in Sprockets↗2018-06-26
▶
OSV
CVE-2018-3760: There is an information leak vulnerability in Sprockets↗2018-06-26
▶
GHSA
Sprockets path traversal leads to information leak↗2018-06-20
▶
OSV
Sprockets path traversal leads to information leak↗2018-06-20
▶
VulnCheck
Red Hat cloudforms Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')↗2018
▶

💥Exploits & PoCs

1
Nuclei
Ruby On Rails - Local File Inclusion
▶

📋Vendor Advisories

2
Red Hat
rubygem-sprockets: Path traversal in forbidden_request?() can allow remote attackers to read arbitrary files↗2018-06-20
▶
Debian
CVE-2018-3760: ruby-sprockets - There is an information leak vulnerability in Sprockets. Versions Affected: 4.0....↗2018
▶

💬Community

3
HackerOne
Path Traversal on Default Installed Rails Application (Asset Pipeline)↗2018-07-19
▶
Bugzilla
CVE-2018-3760 rubygem-sprockets: Path traversal in forbidden_request?() can allow remote attackers to read arbitrary files [fedora-all]↗2018-06-20
▶
Bugzilla
CVE-2018-3760 rubygem-sprockets: Path traversal in forbidden_request?() can allow remote attackers to read arbitrary files↗2018-06-20
▶
CVE-2018-3760 — Path Traversal in Project Sprockets | cvebase