CVE-2014-0130: Ruby on Rails Directory Traversal Vulnerability
Directory traversal vulnerability in actionpack/lib/abstractcontroller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.
Other sources
Directory traversal vulnerability in actionpack/lib/abstractcontroller/base.rb in the implicit-render implementation in Ruby on Rails allows remote attackers to read arbitrary files via a crafted request.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ruby on Rails (actionpack)to a version that resolves this vulnerability.Fixed in 3.2.18 - Upgrade
Upgrade
Ruby on Rails (actionpack)to a version that resolves this vulnerability.Fixed in 4.0.5 - Upgrade
Upgrade
Ruby on Rails (actionpack)to a version that resolves this vulnerability.Fixed in 4.1.1 - Configuration
Disable route globbing/wildcard routes (avoid using glob routes) to prevent implicit-render directory traversal when route globbing configurations are enabled.
Ruby on Rails routing route globbing = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0130?
CVE-2014-0130 is classified as a moderate severity vulnerability.
How do I fix CVE-2014-0130?
To fix CVE-2014-0130, upgrade your Ruby on Rails to version 3.2.18, 4.0.5, or 4.1.1 or later.
What does CVE-2014-0130 allow attackers to do?
CVE-2014-0130 allows remote attackers to read arbitrary files on the server through a directory traversal attack.
Which versions of Ruby on Rails are affected by CVE-2014-0130?
CVE-2014-0130 affects Ruby on Rails versions before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1.
Is CVE-2014-0130 a type of directory traversal vulnerability?
Yes, CVE-2014-0130 is specifically a directory traversal vulnerability in Ruby on Rails.