Bug 2294730 (CVE-2019-1020001)

Summary:	CVE-2019-1020001 rubygem-yard: Arbitrary path traversal and file access in yard server
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bbuckingham, eglynn, ehelms, ggainey, jjoyce, jschluet, juwatts, lhh, lsvaty, mburns, mgarciac, mhulan, nmoumoul, pcreech, pgrist, rchan, zbitter
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A path traversal vulnerability was found in rubygem-yard when using a yard server to serve documentation. This issue allows unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2294731
Bug Blocks:	2294732

Description Pedro Sampaio 2024-06-28 18:46:37 UTC

Impact

A path traversal vulnerability was discovered in YARD <= 0.9.19 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

Thanks to CuongMX from Viettel Cyber Security for discovering this vulnerability.
Patches

Please upgrade to YARD v0.9.20 immediately if you are relying on yard server to host documentation in any untrusted environments.
Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

References:

https://github.com/lsegal/yard/security/advisories/GHSA-xfhh-rx56-rxcr
https://lists.debian.org/debian-lts-announce/2024/03/msg00006.html

Comment 1 Pedro Sampaio 2024-06-28 18:51:42 UTC

Created rubygem-yard tracking bugs for this issue:

Affects: epel-all [bug 2294731]