CVE-2014-7819 sprockets vulnerable to Path Traversal

What is CVE-2014-7819?

CVE-2014-7819 is a medium-severity path traversal vulnerability in n/a, published on 8 Nov 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.

Weakness: CWE-22

Which versions are affected by CVE-2014-7819?

24 open source packages ship an affected version, including sprockets. It affects 1 product.

Products include Sprockets Project Sprockets.

How do I fix CVE-2014-7819?

Upgrade sprockets to a fixed version for your release line: 2.0.5, 2.1.4, 2.10.2 or 2.11.3.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2014-7819 being exploited?

There is no known exploitation of CVE-2014-7819 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2014-7819, GHSA-33pp-3763-mrfp, MGASA-2015-0074, SUSE-SU-2015:0787-1.