CVE-2018-3760 Sprockets path traversal leads to information leak
Attackers can read arbitrary files outside the application root via crafted requests when Sprockets is used in production mode.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-3760?
CVE-2018-3760 is a high-severity path traversal vulnerability in Debian Debian Linux, published on 26 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately.
Which versions are affected by CVE-2018-3760?
6 open source packages ship an affected version, including sprockets. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
sprockets RubyGems | All versions | 2.12.5 |
sprockets RubyGems | All versions | 2.12.5 |
sprockets RubyGems | From 3.0.0 | 3.7.2 |
sprockets RubyGems | From 3.0.0 | 3.7.2 |
sprockets RubyGems | From 4.0.0.beta1 | 4.0.0.beta8 |
sprockets RubyGems | From 4.0.0.beta1 | 4.0.0.beta8 |
Linux distribution packages (20)
rh-ror42-rubygem-sprockets Red Hat:rhel_software_collections:3::el6 | All versions | 0:3.2.0-5.el6 |
rh-ror42-rubygem-sprockets-doc Red Hat:rhel_software_collections:3::el6 | All versions | 0:3.2.0-5.el6 |
rh-ror50-rubygem-sprockets Red Hat:rhel_software_collections:3::el6 | All versions | 0:3.7.1-2.el6 |
rh-ror50-rubygem-sprockets-doc Red Hat:rhel_software_collections:3::el6 | All versions | 0:3.7.1-2.el6 |
rh-ror42-rubygem-sprockets Red Hat:rhel_software_collections:3::el7 | All versions | 0:3.2.0-5.el7 |
rh-ror42-rubygem-sprockets-doc Red Hat:rhel_software_collections:3::el7 | All versions | 0:3.2.0-5.el7 |
rh-ror50-rubygem-sprockets Red Hat:rhel_software_collections:3::el7 | All versions | 0:3.7.1-2.el7 |
rh-ror50-rubygem-sprockets-doc Red Hat:rhel_software_collections:3::el7 | All versions | 0:3.7.1-2.el7 |
rubygem-sprockets SUSE:Linux Enterprise High Availability Extension 15 | All versions | 3.7.2-3.3.1 |
rubygem-sprockets-2_12 SUSE:OpenStack Cloud 7 | All versions | 2.12.5-1.3.1 |
rubygem-sprockets-2_12 SUSE:OpenStack Cloud Crowbar 8 | All versions | 2.12.5-1.4.1 |
ruby3.2-rubygem-sprockets openSUSE:Tumbleweed | All versions | 4.1.1-1.6 |
ruby3.2-rubygem-sprockets-3.7 openSUSE:Tumbleweed | All versions | 3.7.2-1.20 |
rubygem-sprockets openSUSE:Tumbleweed | All versions | 4.0.3-1.1 |
rubygem-sprockets openSUSE:Tumbleweed | All versions | 4.2.1-1.5 |
rubygem-sprockets openSUSE:Tumbleweed | All versions | 4.2.1-1.7 |
rubygem-sprockets openSUSE:Tumbleweed | All versions | 4.2.1-1.9 |
rubygem-sprockets-3.7 openSUSE:Tumbleweed | All versions | 3.7.3-1.1 |
rubygem-sprockets-3.7 openSUSE:Tumbleweed | All versions | 3.7.5-1.3 |
rubygem-sprockets-3.7 openSUSE:Tumbleweed | All versions | 3.7.5-1.5 |
Products include Debian Debian Linux, Redhat Cloudforms, Redhat Enterprise Linux, Sprockets Project Sprockets.
How do I fix CVE-2018-3760?
Upgrade sprockets to a fixed version for your release line: 2.12.5, 3.7.2 or 4.0.0.beta8.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2018-3760 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-3760 exists.
Public exploit code: 1 Nuclei template and 4 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2018-3760, DLA-1419-1, DSA-4242-1, GHSA-pr3h-jjhj-573x, RHSA-2018:2244, RHSA-2018:2245 and 15 more.