Path traversal in ruby-redmine-actionmailer (Alpine package)

1) Path traversal

EUVDB-ID: #VU32465

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2014-7819

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.

Mitigation

Install update from vendor's website.

Vulnerable software versions

ruby-actionmailer (Alpine package): 3.2.13-r0 - 4.0.10-r1

ruby-redmine-actionmailer (Alpine package): 3.2.17-r2 - 3.2.19-r1

CPE2.3

• cpe:2.3:o:alpine:ruby-actionmailer_alpine_package:3.2.13-r0:*:*:*:*:alpine_linux:*:2.5
• cpe:2.3:o:alpine:ruby-actionmailer_alpine_package:4.0.4-r0:*:*:*:*:alpine_linux:*:2.6
• cpe:2.3:o:alpine:ruby-actionmailer_alpine_package:4.0.5-r1:*:*:*:*:alpine_linux:*:2.6
• cpe:2.3:o:alpine:ruby-redmine-actionmailer_alpine_package:3.2.17-r2:*:*:*:*:alpine_linux:*:2.6
• cpe:2.3:o:alpine:ruby-redmine-actionmailer_alpine_package:3.2.19-r0:*:*:*:*:alpine_linux:*:2.7
• cpe:2.3:o:alpine:ruby-redmine-actionmailer_alpine_package:3.2.19-r1:*:*:*:*:alpine_linux:*:2.7

External links

https://git.alpinelinux.org/aports/commit/?id=dad2215438e3ff0d93efdc6b8a7c4f03bd9a4292
https://git.alpinelinux.org/aports/commit/?id=6c9332933b4506fd7325c6066adabc32d2a6fac0
https://git.alpinelinux.org/aports/commit/?id=e9cf2371bef95401aee294e176db38d939df2b13
https://git.alpinelinux.org/aports/commit/?id=0d683347f6dbd7b6c31cc7800d8be4203045431e

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.