Bug 1301963 (CVE-2016-0752)

Summary: CVE-2016-0752 rubygem-actionview, rubygem-actionpack: directory traversal flaw in Action View
Product: [Other] Security Response Reporter: Adam Mariš <amaris>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: apatters, bkearney, cbillett, ccoleman, cpelland, dajohnso, dclarizi, dmcphers, gblomqui, gmccullo, gtanzill, hhorak, jfrey, jhardy, jialiu, joelsmith, jokerman, jorton, jprause, jrusnack, katello-bugs, kseifried, lmeyer, mmaslano, mmccomas, obarenbo, osoukup, pvalena, roliveri, slong, strzibny, tomckay, vondruch, xlecauch
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: rubygem-actionview 5.0.0.beta1.1, rubygem-actionview 4.2.5.1, rubygem-actionview 4.1.14.1, rubygem-pack 3.2.22.1 Doc Type: Bug Fix
Doc Text:
A directory traversal flaw was found in the way the Action View component searched for templates for rendering. If an application passed untrusted input to the 'render' method, a remote, unauthenticated attacker could use this flaw to render unexpected files and, possibly, execute arbitrary code.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2016-03-15 21:22:29 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1301964, 1306275, 1306276, 1306277, 1306278, 1306279, 1306281, 1306288, 1306289    
Bug Blocks: 1302006    
Attachments:
Description Flags
3.2 patch
none
4.1 patch
none
4.2 patch
none
5.0 patch none

Description Adam Mariš 2016-01-26 12:55:44 UTC 
A possible directory traversal and information leak vulnerability in Action View was reported. Applications that pass unverified user input to the `render` method in a controller may be vulnerable to an information leak vulnerability.

Vulnerable code:

```ruby
def index
  render params[:id]
end
```

Carefully crafted requests can cause the above code to render files from unexpected places like outside the application's view directory, and can possibly escalate this to a remote code execution attack. All versions are affected.

http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/

External References:

https://groups.google.com/forum/#!msg/rubyonrails-security/335P1DcLG00/OfB9_LhbFQAJ
https://nvisium.com/blog/2016/01/26/rails-dynamic-render-to-rce-cve-2016-0752/
Comment 1 Adam Mariš 2016-01-26 12:56:12 UTC 
Created rubygem-actionview tracking bugs for this issue:

Affects: fedora-all [bug 1301964]
Comment 3 Ján Rusnačko 2016-01-29 15:02:01 UTC 
Created attachment 1119445 [details]
3.2 patch
Comment 4 Ján Rusnačko 2016-01-29 15:02:41 UTC 
Created attachment 1119446 [details]
4.1 patch
Comment 5 Ján Rusnačko 2016-01-29 15:03:11 UTC 
Created attachment 1119447 [details]
4.2 patch
Comment 6 Ján Rusnačko 2016-01-29 15:04:20 UTC 
Created attachment 1119449 [details]
5.0 patch
Comment 9 Tomas Hoger 2016-02-05 14:14:46 UTC 
Upstream commit:

3.2 https://github.com/rails/rails/commit/18269d250fa58001ce7d8318571546aa90412975
4.1 https://github.com/rails/rails/commit/be543e8e18246d5c2faa336eb3c0a03b797f3517
4.2 https://github.com/rails/rails/commit/0c5c32aa7cea5ee1ea60bd1f87dfa5c7e7146a54
Comment 14 errata-xmlrpc 2016-02-24 10:37:27 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6

Via RHSA-2016:0296 https://rhn.redhat.com/errata/RHSA-2016-0296.html
Comment 15 Fedora Update System 2016-02-28 08:27:55 UTC 
rubygem-actionview-4.2.0-3.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
Comment 16 Fedora Update System 2016-02-28 12:26:40 UTC 
rubygem-actionview-4.2.3-3.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
Comment 18 errata-xmlrpc 2016-03-15 21:00:40 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS

Via RHSA-2016:0455 https://rhn.redhat.com/errata/RHSA-2016-0455.html
Comment 19 errata-xmlrpc 2016-03-15 21:03:31 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS

Via RHSA-2016:0454 https://rhn.redhat.com/errata/RHSA-2016-0454.html
Comment 20 Stephen Herr 2017-12-02 00:16:17 UTC 
Mitigation:

Avoid passing untrusted input to render method, or verify the input using whitelist before passing it to the render method:

```

def index
  render verify_template(params[:id])
end

private
def verify_template(name)
  # add verification logic particular to your application here
end

```