CVE-2019-5418: Rails Ruby on Rails Path Traversal Vulnerability
File Content Disclosure in Action View
Impact ------ There is a possible file content disclosure vulnerability in Action View. Specially crafted accept headers in combination with calls to render file: can cause arbitrary files on the target server to be rendered, disclosing the file contents.
The impact is limited to calls to render which render file contents without a specified accept format. Impacted code in a controller looks something like this:
ruby class UserController < ApplicationController def index render file: "#{Rails.root}/some/file" end end
Rendering templates as opposed to files is not impacted by this vulnerability.
All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases -------- The 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, and 4.2.11.1 releases are available at the normal locations.
Workarounds ----------- This vulnerability can be mitigated by specifying a format for file rendering, like this:
ruby class UserController < ApplicationController def index render file: "#{Rails.root}/some/file", formats: [:html] end end
In summary, impacted calls to render look like this:
render file: "#{Rails.root}/some/file"
The vulnerability can be mitigated by changing to this:
render file: "#{Rails.root}/some/file", formats: [:html]
Other calls to render are not impacted.
Alternatively, the following monkey patch can be applied in an initializer:
ruby $ cat config/initializers/formatsfilter.rb frozenstringliteral: true
ActionDispatch::Request.prepend(Module.new do def formats super().select do |format| format.symbol || format.ref == "/" end end end)
Credits ------- Thanks to John Hawthorn <john@hawthorn.email> of GitHub
Other sources
Rails Ruby on Rails contains a path traversal vulnerability in Action View. Specially crafted accept headers in combination with calls to render file: can cause arbitrary files on the target server to be rendered, disclosing the file contents.
— CISA
There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.
There is a possible file content disclosure vulnerability in Action View. Specially crafted accept headers in combination with calls to render file: can cause arbitrary files on the target server to be rendered, disclosing the file contents.
External References:
https://groups.google.com/forum/#!msg/rubyonrails-security/pFRKI96Sm8Q/IhpRq9D2CgAJ https://github.com/mpgn/CVE-2019-5418
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rubygem-actionviewto a version that resolves this vulnerability.Fixed in 6.0.0. - Upgrade
Upgrade
redhat/rubygem-actionviewto a version that resolves this vulnerability.Fixed in 5.2.2.1 - Upgrade
Upgrade
redhat/rubygem-actionviewto a version that resolves this vulnerability.Fixed in 5.1.6.2 - Upgrade
Upgrade
redhat/rubygem-actionviewto a version that resolves this vulnerability.Fixed in 5.0.7.2 - Upgrade
Upgrade
redhat/rubygem-actionviewto a version that resolves this vulnerability.Fixed in 4.2.11.1 - Upgrade
Upgrade
rubygems/actionviewto a version that resolves this vulnerability.Fixed in 4.2.11.1 - Upgrade
Upgrade
rubygems/actionviewto a version that resolves this vulnerability.Fixed in 5.2.2.1 - Upgrade
Upgrade
rubygems/actionviewto a version that resolves this vulnerability.Fixed in 5.0.7.2 - Upgrade
Upgrade
rubygems/actionviewto a version that resolves this vulnerability.Fixed in 5.1.6.2 - Configuration
Specify a format when rendering files. For example: render file: "#{Rails.root}/some/file", formats: [:html] to mitigate file content disclosure.
Action View (render file) formats = [:html] - Configuration
Add an initializer (e.g., config/initializers/formats_filter.rb) that prepends a module to ActionDispatch::Request to filter formats as shown in the advisory to mitigate the vulnerability.
Rails initializer ActionDispatch::Request#formats filter = apply provided monkey patch - Operational
Identify and remediate impacted calls to render that render file contents without a specified format (e.g., any render file: calls without formats:) by updating them to specify formats or applying the provided workaround.
- Operational
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Event History
Frequently Asked Questions
What is CVE-2019-5418?
CVE-2019-5418 is a File Content Disclosure vulnerability in Action View.
How does CVE-2019-5418 impact systems?
CVE-2019-5418 can cause arbitrary files on the target server to be rendered, disclosing their content.
What is the severity of CVE-2019-5418?
CVE-2019-5418 has a severity rating of 7.5 (High).
Which versions of Action View are affected by CVE-2019-5418?
Action View versions <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 are affected by CVE-2019-5418.
How can I fix CVE-2019-5418?
To fix CVE-2019-5418, update Action View to versions 5.2.2.1, 5.1.6.2, 5.0.7.2, or 4.2.11.1.