CVE-2018-3760: Path Traversal
rubygem-sprockets before versions 2.12.5, 3.7.2 and 4.0.0beta8 are vulnerable to a path traversal flaw in the sprockets/server.rb:forbiddenrequest?() function. A remote attacker could exploit this to read arbitrary files from the Sprockets server.
External References:
http://www.openwall.com/lists/oss-security/2018/06/19/2 https://blog.heroku.com/rails-asset-pipeline-vulnerability
Upstream Patch:
https://github.com/rails/sprockets/commit/c09131cf5b2c479263939c8582e22b98ed616c5f
Other sources
Specially crafted requests can be used to access files that exist on the filesystem that is outside an application's root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately. Workaround: In Rails applications, work around this issue, set config.assets.compile = false and config.publicfileserver.enabled = true in an initializer and precompile the assets.
This work around will not be possible in all hosting environments and upgrading is advised.
There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2018-3760?
CVE-2018-3760 is an information leak vulnerability in Sprockets that allows specially crafted requests to access files outside of an application's root directory.
Which versions of Sprockets are affected by CVE-2018-3760?
Versions 4.0.0.beta7 and lower 3.x versions of Sprockets are affected by CVE-2018-3760.
How severe is CVE-2018-3760?
CVE-2018-3760 has a severity rating of 7.5 (high).
What is the remedy for CVE-2018-3760?
Affected users should upgrade to version 4.0.0.beta8 or use one of the workarounds provided.
Where can I find more information about CVE-2018-3760?
More information about CVE-2018-3760 can be found at the following links: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2018-3760), [Red Hat Security Advisories](https://access.redhat.com/errata/RHSA-2018:2244,https://access.redhat.com/errata/RHSA-2018:2245).