CVE-2016-0752 Ruby on Rails Directory Traversal
Remote attackers can read arbitrary files by exploiting path traversal in Ruby on Rails Action View when the render method is used without restrictions.
- Exploited in the wild
- Since 25 Mar 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-0752?
CVE-2016-0752 is a high-severity path traversal vulnerability in Debian Debian Linux, published on 16 Feb 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.
Weakness: CWE-22
Which versions are affected by CVE-2016-0752?
10 open source packages ship an affected version, including actionpack and actionview. It affects 6 products.
| Package | Affected | Fixed in |
|---|---|---|
actionpack RubyGems | All versions | 3.2.22.1 |
actionpack RubyGems | All versions | 3.2.22.1 |
actionpack RubyGems | From 4.0.0 | 4.1.14.1 |
actionpack RubyGems | From 4.0.0 | 4.1.14.1 |
actionpack RubyGems | From 4.2.0 | 4.2.5.1 |
actionpack RubyGems | From 4.2.0 | 4.2.5.1 |
4 more packages
actionview RubyGems | From 4.0.0 | 4.1.14.1 |
actionview RubyGems | From 4.0.0 | 4.1.14.1 |
actionview RubyGems | From 4.2.0 | 4.2.5.1 |
actionview RubyGems | From 4.2.0 | 4.2.5.1 |
Linux distribution packages (2)
rubygem-actionview-4_2 SUSE:Enterprise Storage 2.1 | All versions | 4.2.2-5.1 |
rubygem-actionview-4_1 SUSE:OpenStack Cloud 5 | All versions | 4.1.9-9.1 |
Products include Debian Debian Linux, Opensuse Leap, Opensuse Opensuse, Redhat Software Collections, Rubyonrails Rails, Suse Linux Enterprise Module for Containers.
How do I fix CVE-2016-0752?
Upgrade actionpack to a fixed version for your release line: 3.2.22.1, 4.1.14.1 or 4.2.5.1. US federal agencies must fix it by 15 Apr 2022.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2016-0752 being exploited?
Yes. Attackers have exploited CVE-2016-0752 in the wild since at least 25 Mar 2022.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry and 2 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2016-0752, GHSA-xrr4-p6fq-hjg7, SUSE-SU-2016:0456-1, SUSE-SU-2016:0599-1.