oss-sec mailing list archives
Re: [AMENDED] [CVE-2014-0130] Ruby on Rails: Directory Traversal Vulnerability With Certain Route Configurations
From: Reed Loden <reed () reedloden com>
Date: Thu, 29 May 2014 13:27:46 -0700
On Wed, 7 May 2014 11:53:12 -0500 Jacob Kaplan-Moss <jacob () heroku com> wrote:
Can you clarify what these "additional attack vectors" are? We've been looking at this closely here at Heroku, and as far as we can tell it's only the original vector (*action/:action). What are we missing here?
...
We'd like to be better able to evaluate if we're vulnerable -- and, more importantly, we'd like to understand if this is a big enough deal for us to notify our customers and directly encourage them to upgrade (a step we've taken in the past). However, without more details about these "additional vectors" we're kinda shooting in the dark. Can you share more details?
Matasano just released a paper on this particular vulnerability that you might want to check out. "Jeff Jarmoc explains why the recent Ruby on Rails 'implicit render' vulnerability (CVE-2014-0130) is more serious than many have been lead to believe. In this paper he shows how to go from an arbitrary file read under highly unusual configurations to RCE in more common setups." http://matasano.com/research/AnatomyOfRailsVuln-CVE-2014-0130.pdf ~reed
Current thread:
- [AMENDED] [CVE-2014-0130] Ruby on Rails: Directory Traversal Vulnerability With Certain Route Configurations Rafael Mendonça França (May 06)
- Re: [AMENDED] [CVE-2014-0130] Ruby on Rails: Directory Traversal Vulnerability With Certain Route Configurations Jacob Kaplan-Moss (May 07)
- Re: [AMENDED] [CVE-2014-0130] Ruby on Rails: Directory Traversal Vulnerability With Certain Route Configurations Kurt Seifried (May 07)
- Re: [AMENDED] [CVE-2014-0130] Ruby on Rails: Directory Traversal Vulnerability With Certain Route Configurations Reed Loden (May 29)
- Re: [AMENDED] [CVE-2014-0130] Ruby on Rails: Directory Traversal Vulnerability With Certain Route Configurations Jacob Kaplan-Moss (May 07)