CVE-2016-2097: Actionview Path Traversal Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-vx9j-46rh-fqr8",
  "modified" : "2023-07-05T20:44:17Z",
  "published" : "2017-10-24T18:33:35Z",
  "aliases" : [ "CVE-2016-2097" ],
  "summary" : "actionview contains Path Traversal vulnerability",
  "details" : "There is a possible directory traversal and information leak vulnerability in Action View. This was meant to be fixed on CVE-2016-0752. However the 3.2 patch was not covering all possible scenarios. This vulnerability has been assigned the CVE identifier CVE-2016-2097.\n\nVersions Affected:  3.2.x, 4.0.x, 4.1.x\nNot affected:       4.2+\nFixed Versions:     3.2.22.2, 4.1.14.2\n\nImpact\n------\nApplications that pass unverified user input to the `render` method in a controller may be vulnerable to an information leak vulnerability.\n\nImpacted code will look something like this:\n\n```ruby\ndef index\n  render params[:id]\nend\n```\n\nCarefully crafted requests can cause the above code to render files from unexpected places like outside the application's view directory, and can possibly escalate this to a remote code execution attack.\n\nAll users running an affected release should either upgrade or use one of the workarounds immediately.\n\nReleases\n--------\nThe FIXED releases are available at the normal locations.\n\nWorkarounds\n-----------\nA workaround to this issue is to not pass arbitrary user input to the `render` method. Instead, verify that data before passing it to the `render` method.\n\nFor example, change this:\n\n```ruby\ndef index\n  render params[:id]\nend\n```\n\nTo this:\n\n```ruby\ndef index\n  render verify_template(params[:id])\nend\n\nprivate\ndef verify_template(name)\n  # add verification logic particular to your application here\nend\n```\n\nPatches\n-------\nTo aid users who aren't able to upgrade immediately we have provided patches for it. It is in git-am format and consist of a single changeset.\n\n* 3-2-render_data_leak_2.patch - Patch for 3.2 series\n* 4-1-render_data_leak_2.patch - Patch for 4.1 series\n\nCredits\n-------\nThanks to both Jyoti Singh and Tobias Kraze from makandra for reporting this and working with us in the patch!",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "RubyGems",
      "name" : "actionview"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.0.0"
      }, {
        "fixed" : "3.2.22.2"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 3.2.22.1"
    }
  }, {
    "package" : {
      "ecosystem" : "RubyGems",
      "name" : "actionview"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "4.0.0"
      }, {
        "fixed" : "4.1.14.2"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 4.1.14.1"
    }
  }, {
    "package" : {
      "ecosystem" : "RubyGems",
      "name" : "actionpack"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.0.0"
      }, {
        "fixed" : "3.2.22.2"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 3.2.22.1"
    }
  }, {
    "package" : {
      "ecosystem" : "RubyGems",
      "name" : "actionpack"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "4.0.0"
      }, {
        "fixed" : "4.1.14.2"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 4.1.14.1"
    }
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2016-2097"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/rails/rails/commit/8a1d3ea617ffb0c8ae8467fa439bf63a3bfc4324"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/rails/rails"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2016-2097.yml"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2016-2097.yml"
  }, {
    "type" : "WEB",
    "url" : "https://groups.google.com/forum/#!topic/rubyonrails-security/ddY6HgqB2z4"
  }, {
    "type" : "WEB",
    "url" : "https://web.archive.org/web/20160322002234/http://www.securitytracker.com/id/1035122"
  }, {
    "type" : "WEB",
    "url" : "https://web.archive.org/web/20200228015320/http://www.securityfocus.com/bid/83726"
  }, {
    "type" : "WEB",
    "url" : "https://web.archive.org/web/20201221115217/https://groups.google.com/forum/message/raw?msg=rubyonrails-security/ddY6HgqB2z4/we0RasMZIAAJ"
  }, {
    "type" : "WEB",
    "url" : "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00080.html"
  }, {
    "type" : "WEB",
    "url" : "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00083.html"
  }, {
    "type" : "WEB",
    "url" : "http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00006.html"
  }, {
    "type" : "WEB",
    "url" : "http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released"
  }, {
    "type" : "WEB",
    "url" : "http://www.debian.org/security/2016/dsa-3509"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-22" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2020-06-16T21:58:49Z",
    "nvd_published_at" : "2016-04-07T23:59:05Z"
  }
}