CVE-2018-3760
published 2018-06-26CVE-2018-3760: There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted…
PriorityP181high7.5CVSS 3.0
AVNACLPRNUINSUCHINAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
26.72%
97.8th percentile
There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | ruby-sprockets | < ruby-sprockets 3.7.0-1.1 (bookworm) | ruby-sprockets 3.7.0-1.1 (bookworm) |
| hackerone | sprockets | — | — |
| redhat | cloudforms | — | — |
| redhat | cloudforms | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| sprockets_project | sprockets | — | — |
| sprockets_project | sprockets | >= 0 < 2.12.5 | 2.12.5 |
| sprockets_project | sprockets | 2.0.0 – 2.12.4 | — |
| sprockets_project | sprockets | >= 3.0.0 < 3.7.2 | 3.7.2 |
| sprockets_project | sprockets | 3.0.0 – 3.7.1 | — |
| sprockets_project | sprockets | >= 4.0.0.beta1 < 4.0.0.beta8 | 4.0.0.beta8 |
Detection & IOCsextracted from sources · hover to see the quote
urlGET /assets/file:%2f%2f{{path}}/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/etc/passwd HTTP/1.1↗
yara↗
regex: root:.*:0:0:
- →Detect double-URL-encoded path traversal sequences (%252e%252e) in HTTP requests targeting the /assets/ endpoint, which indicates secondary decoding exploitation of Sprockets. ↗
- →Look for requests to /assets/ containing 'file:%2f%2f' or 'file://' URI schemes, which are used to directly reference filesystem paths outside the application root. ↗
- →Monitor HTTP responses for the error string '/etc/passwd is no longer under a load path:' in the response body, which leaks the server's load path and can be used as a second-stage extractor for further traversal. ↗
- →The vulnerable function is forbidden_request?() in sprockets/server.rb; monitor for path traversal bypass of this function via double-encoded dot-dot sequences. ↗
- →Successful exploitation returns HTTP 200 with /etc/passwd content (root:.*:0:0: pattern); alert on 200 responses to /assets/ requests containing traversal sequences. ↗
- ·The path traversal via Sprockets is only exploitable in production when config.assets.compile = true; this is NOT the default for production Rails apps, limiting exposure. ↗
- ·Workaround (not a fix): set config.assets.compile = false and config.public_file_server.enabled = true in an initializer and precompile assets. Note this workaround is not possible in all hosting environments. ↗
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv7.5HIGH
vulncheck7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2018-3760: There is an information leak vulnerability in Sprockets
osv·2018-06-26·CVSS 7.5
CVE-2018-3760 [HIGH] CVE-2018-3760: There is an information leak vulnerability in Sprockets
There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately.
GHSA
Sprockets path traversal leads to information leak
ghsa·2018-06-20
CVE-2018-3760 [HIGH] CWE-200 Sprockets path traversal leads to information leak
Sprockets path traversal leads to information leak
Specially crafted requests can be used to access files that exist on the filesystem that is outside an application's root directory, when the Sprockets server is used in production.
All users running an affected release should either upgrade or use one of the work arounds immediately.
### Workaround:
In Rails applications, work around this issue, set `config.assets.compile = false` and `config.public_file_server.enabled = true` in an initializer and precompile the assets.
This work around will not be possible in all hosting environments and upgrading is advised.
OSV
Sprockets path traversal leads to information leak
osv·2018-06-20
CVE-2018-3760 [HIGH] Sprockets path traversal leads to information leak
Sprockets path traversal leads to information leak
Specially crafted requests can be used to access files that exist on the filesystem that is outside an application's root directory, when the Sprockets server is used in production.
All users running an affected release should either upgrade or use one of the work arounds immediately.
### Workaround:
In Rails applications, work around this issue, set `config.assets.compile = false` and `config.public_file_server.enabled = true` in an initializer and precompile the assets.
This work around will not be possible in all hosting environments and upgrading is advised.
VulnCheck
Red Hat cloudforms Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
vulncheck·2018·CVSS 7.5
CVE-2018-3760 [HIGH] Red Hat cloudforms Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Red Hat cloudforms Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately.
Affected: Red Hat cloudforms
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://api.vulncheck.com/v3/index/sans-dshield?cve=CVE-2018-3760;
Red Hat
rubygem-sprockets: Path traversal in forbidden_request?() can allow remote attackers to read arbitrary files
vendor_redhat·2018-06-20·CVSS 7.5
CVE-2018-3760 [HIGH] CWE-22 rubygem-sprockets: Path traversal in forbidden_request?() can allow remote attackers to read arbitrary files
rubygem-sprockets: Path traversal in forbidden_request?() can allow remote attackers to read arbitrary files
There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately.
Mitigation: Ensure config.assets.compile = false in production.rb.
Package: ruby193-rubygem-sprockets (Red Hat Ceph Storage 1.3) - Will not fix
Package: ruby193-rubygem-sprockets (Red Hat Satellite 6) - Not affected
Package: ruby193-rubygem-sprockets (Red Hat Subsc
Debian
CVE-2018-3760: ruby-sprockets - There is an information leak vulnerability in Sprockets. Versions Affected: 4.0....
vendor_debian·2018·CVSS 7.5
CVE-2018-3760 [HIGH] CVE-2018-3760: ruby-sprockets - There is an information leak vulnerability in Sprockets. Versions Affected: 4.0....
There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately.
Scope: local
bookworm: resolved (fixed in 3.7.0-1.1)
bullseye: resolved (fixed in 3.7.0-1.1)
forky: resolved (fixed in 3.7.0-1.1)
sid: resolved (fixed in 3.7.0-1.1)
trixie: resolved (fixed in 3.7.0-1.1)
No detection rules found.
Nuclei
Ruby On Rails - Local File Inclusion
nuclei·CVSS 7.5
CVE-2018-3760 [HIGH] Ruby On Rails - Local File Inclusion
Ruby On Rails - Local File Inclusion
Ruby On Rails is vulnerable to local file inclusion caused by secondary decoding in Sprockets 3.7.1 and lower versions. An attacker can use %252e%252e/ to access the root directory and read or execute any file on the target server.
Template:
id: CVE-2018-3760
info:
name: Ruby On Rails - Local File Inclusion
author: 0xrudra,pikpikcu
severity: high
description: |
Ruby On Rails is vulnerable to local file inclusion caused by secondary decoding in Sprockets 3.7.1 and lower versions. An attacker can use %252e%252e/ to access the root directory and read or execute any file on the target server.
impact: |
This vulnerability can lead to unauthorized access to sensitive files and information stored on the server.
remediation: |
Apply the latest security patc
HackerOne
Path Traversal on Default Installed Rails Application (Asset Pipeline)
hackerone·2018-07-19·CVSS 7.5
CVE-2018-3760 [HIGH] Path Traversal on Default Installed Rails Application (Asset Pipeline)
Path Traversal on Default Installed Rails Application (Asset Pipeline)
There is an information leak vulnerability in Sprockets. This vulnerability
has been assigned the CVE identifier CVE-2018-3760.
Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower.
Not affected: NONE
Fixed Versions: 4.0.0.beta8, 3.7.2, 2.12.5
Impact
Specially crafted requests can be used to access files that exists on
the filesystem that is outside an application's root directory, when the Sprockets server is
used in production.
All users running an affected release should either upgrade or use one of the work arounds immediately.
Releases
The 4.0.0.beta8, 3.7.2 and 2.12.5 releases are available at the normal locations.
Workarounds
In Rails applications, work around this issue, set `config.
Bugzilla
CVE-2018-3760 rubygem-sprockets: Path traversal in forbidden_request?() can allow remote attackers to read arbitrary files [fedora-all]
bugzilla·2018-06-20·CVSS 7.5
CVE-2018-3760 [HIGH] CVE-2018-3760 rubygem-sprockets: Path traversal in forbidden_request?() can allow remote attackers to read arbitrary files [fedora-all]
CVE-2018-3760 rubygem-sprockets: Path traversal in forbidden_request?() can allow remote attackers to read arbitrary files [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit mess
Bugzilla
CVE-2018-3760 rubygem-sprockets: Path traversal in forbidden_request?() can allow remote attackers to read arbitrary files
bugzilla·2018-06-20·CVSS 7.5
CVE-2018-3760 [HIGH] CVE-2018-3760 rubygem-sprockets: Path traversal in forbidden_request?() can allow remote attackers to read arbitrary files
CVE-2018-3760 rubygem-sprockets: Path traversal in forbidden_request?() can allow remote attackers to read arbitrary files
rubygem-sprockets before versions 2.12.5, 3.7.2 and 4.0.0beta8 are vulnerable to a path traversal flaw in the sprockets/server.rb:forbidden_request?() function. A remote attacker could exploit this to read arbitrary files from the Sprockets server.
External References:
http://www.openwall.com/lists/oss-security/2018/06/19/2
https://blog.heroku.com/rails-asset-pipeline-vulnerability
Upstream Patch:
https://github.com/rails/sprockets/commit/c09131cf5b2c479263939c8582e22b98ed616c5f
Discussion:
Created rubygem-sprockets tracking bugs for this issue:
Affects: fedora-all [bug 1593059]
---
Red Hat Ceph Storage 1.3 shipped ruby193-rubygem-sprockets as dependency fo
https://access.redhat.com/errata/RHSA-2018:2244https://access.redhat.com/errata/RHSA-2018:2245https://access.redhat.com/errata/RHSA-2018:2561https://access.redhat.com/errata/RHSA-2018:2745https://github.com/rails/sprockets/commit/c09131cf5b2c479263939c8582e22b98ed616c5fhttps://github.com/rails/sprockets/commit/9c34fa05900b968d74f08ccf40917848a7be9441https://github.com/rails/sprockets/commit/18b8a7f07a50c245e9aee7854ecdbe606bbd8bb5https://groups.google.com/d/msg/rubyonrails-security/ft_J--l55fM/7roDfQ50BwAJhttps://www.debian.org/security/2018/dsa-4242https://access.redhat.com/errata/RHSA-2018:2244https://access.redhat.com/errata/RHSA-2018:2245https://access.redhat.com/errata/RHSA-2018:2561https://access.redhat.com/errata/RHSA-2018:2745https://github.com/rails/sprockets/commit/c09131cf5b2c479263939c8582e22b98ed616c5fhttps://github.com/rails/sprockets/commit/9c34fa05900b968d74f08ccf40917848a7be9441https://github.com/rails/sprockets/commit/18b8a7f07a50c245e9aee7854ecdbe606bbd8bb5https://groups.google.com/d/msg/rubyonrails-security/ft_J--l55fM/7roDfQ50BwAJhttps://www.debian.org/security/2018/dsa-4242
2018-06-26
Published
Exploited in the wild