CVE-2016-0752highunder attackCWE-22

CVE-2016-0752

Published · Updated

Follow this CVE+ Monitor Ruby on Rails+ Monitor rails

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 7.5epss 96%
from disclosure to weaponsame day
Published on NVDFeb 16
1st PoCJan 26
metasploit+243d
CISA KEV+2229d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
2 products (3 components)
Red Hat Subscription Asset Manager · CloudForms Management Engine 5
workaround: Avoid passing untrusted input to render method, or verify the input using whitelist before passing it to the render method: ``` def index render verify_template(params[:id]) end private def verify_template(name) # add verification logic particular…
Fixed
8 products (240 components)
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) · Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) · Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6) · Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) · Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1) · and others 3
fix ↗
Action required by CISAfederal deadline: 2022-04-15

Apply updates per vendor instructions.

In short

A flaw in Ruby on Rails allows attackers to read files they shouldn't access by using special path tricks (like ".." in filenames) when the application renders templates. This happens when developers don't properly restrict what files can be displayed.

Technical detail

Directory traversal vulnerability in Rails Action View via improper path validation in the render method. Attackers can bypass pathname restrictions using dot-dot sequences to traverse the filesystem and access arbitrary files. Affects Rails 3.2.x, 4.0.x, 4.1.x, 4.2.x, and 5.x before specific patch versions.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.