CVE-2021-43840: Path traversal in message_bus
Impact
Users who deployed message bus with diagnostics features enabled (default off) were vulnerable to a path traversal bug, which could lead to disclosure of secret information on a machine if an unintended user were to gain access to the diagnostic route. The impact is also greater if there is no proxy for your web application as the number of steps up the directories is not bounded. For deployments which uses a proxy, the impact varies. For example, If a request goes through a proxy like Nginx with mergeslashes enabled, the number of steps up the directories that can be read is limited to 3 levels.
Patches
Patched in 3.3.7.
Workarounds
Disable MessageBus::Diagnostics in production like environments.
Other sources
messagebus is a messaging bus for Ruby processes and web clients. In versions prior to 3.3.7 users who deployed message bus with diagnostics features enabled (default off) are vulnerable to a path traversal bug, which could lead to disclosure of secret information on a machine if an unintended user were to gain access to the diagnostic route. The impact is also greater if there is no proxy for your web application as the number of steps up the directories is not bounded. For deployments which uses a proxy, the impact varies. For example, If a request goes through a proxy like Nginx with mergeslashes enabled, the number of steps up the directories that can be read is limited to 3 levels. This issue has been patched in version 3.3.7. Users unable to upgrade should ensure that MessageBus::Diagnostics is disabled.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2021-43840?
The severity of CVE-2021-43840 is classified as high due to the potential for secret information disclosure.
How do I fix CVE-2021-43840?
To address CVE-2021-43840, ensure that diagnostics features are disabled in the message bus configuration.
Who is affected by CVE-2021-43840?
CVE-2021-43840 affects users of the message bus library version 3.3.7 and below when diagnostics features are enabled.
What type of vulnerability is CVE-2021-43840?
CVE-2021-43840 is a path traversal vulnerability that can lead to information disclosure.
What are the consequences of CVE-2021-43840?
The consequences of CVE-2021-43840 include the unauthorized access to sensitive information on the affected machine.