CVE-2014-0130 Ruby on Rails Directory Traversal
Remote attackers can read arbitrary files via crafted requests in Ruby on Rails when specific route globbing configurations are enabled.
- Exploited in the wild
- Since 25 Mar 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-0130?
CVE-2014-0130 is a high-severity path traversal vulnerability in Redhat Enterprise Linux Server, published on 7 May 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.
Weakness: CWE-22
Which versions are affected by CVE-2014-0130?
6 open source packages ship an affected version, including actionpack. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
actionpack RubyGems | From 3.0.0 | 3.2.18 |
actionpack RubyGems | From 3.0.0 | 3.2.18 |
actionpack RubyGems | From 4.0.0 | 4.0.5 |
actionpack RubyGems | From 4.0.0 | 4.0.5 |
actionpack RubyGems | From 4.1.0 | 4.1.1 |
actionpack RubyGems | From 4.1.0 | 4.1.1 |
Linux distribution packages (2)
ruby193-rubygem-actionpack Red Hat:rhel_software_collections:1::el6 | All versions | 1:3.2.8-5.5.el6 |
ruby193-rubygem-actionpack-doc Red Hat:rhel_software_collections:1::el6 | All versions | 1:3.2.8-5.5.el6 |
Products include Redhat Enterprise Linux Server, Redhat Subscription Asset Manager, Rubyonrails Rails.
How do I fix CVE-2014-0130?
Upgrade actionpack to a fixed version for your release line: 3.2.18, 4.0.5 or 4.1.1. US federal agencies must fix it by 15 Apr 2022.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2014-0130 being exploited?
Yes. Attackers have exploited CVE-2014-0130 in the wild since at least 25 Mar 2022.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Redhat Enterprise Linux Server
Sources
Also known as GHSA-6x85-j5j2-27jx, RHSA-2014:0510.