[AMENDED] [CVE-2014-0130] Directory Traversal Vulnerability With Certain Route Configurations

[Rafael Mendonça França]

An earlier version of this advisory incorrectly assumed that the only way to trigger this vulnerability was with routes containing '*action'.  There are additional attack vectors and as a result *all* users are advised to upgrade to a fixed version as soon as possible.

There is a vulnerability in the 'implicit render' functionality in Ruby on Rails. This vulnerability has been assigned the CVE identifier CVE-2014-0130.

Versions Affected:  All Supported
Not affected:       None
Fixed Versions:     4.1.1, 4.0.5, 3.2.18

Impact
------
The implicit render functionality allows controllers to render a template, even if there is no explicit action with the corresponding name.  This module does not perform adequate input sanitization which could allow an attacker to use a specially crafted request to retrieve arbitrary files from the rails application server.

Releases
--------
The 4.1.1, 4.0.5 & 3.2.18 releases are available at the normal locations.

Workarounds
-----------

There are no feasible work arounds for this issue.

If your application depends on this functionality, you will need to rename the route parameter and add an explicit action:

  get 'my_url/*template_path', controller: 'asdf', action: 'display'

Then add an action which renders explicitly:

  def display
    if !params[:template_path].index('.')
      render file: params[:template_path]
    end
  end

Note: The path check in this example may not be suitable for your application, take care.

Patches 
------- 
To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series.  They are in git-am format and consist of a single changeset. 

* 4-1-directory_traversal.patch - Patch for 4.1 series
* 4-0-directory_traversal.patch - Patch for 4.0 series
* 3-2-directory_traversal.patch - Patch for 3.2 series

Please note that only the 4.1.x, 4.0.x and 3.2.x series are supported at present.  Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

Credits 
------- 
Thanks to Ville Lautanala of Flowdock for reporting the vulnerability to us, and working with us on a fix. Additional thanks to Tobias Kraze and Thomas Eisenbarth of makandra for correcting our earlier error.