Bug 2294730 (CVE-2019-1020001) - CVE-2019-1020001 rubygem-yard: Arbitrary path traversal and file access in yard server
Summary: CVE-2019-1020001 rubygem-yard: Arbitrary path traversal and file access in ya...
Keywords:
Status: NEW
Alias: CVE-2019-1020001
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2294731
Blocks: 2294732
TreeView+ depends on / blocked
 
Reported: 2024-06-28 18:46 UTC by Pedro Sampaio
Modified: 2024-07-01 12:16 UTC (History)
17 users (show)

Fixed In Version:
Doc Type: ---
Doc Text:
A path traversal vulnerability was found in rubygem-yard when using a yard server to serve documentation. This issue allows unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Pedro Sampaio 2024-06-28 18:46:37 UTC 
Impact

A path traversal vulnerability was discovered in YARD <= 0.9.19 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

Thanks to CuongMX from Viettel Cyber Security for discovering this vulnerability.
Patches

Please upgrade to YARD v0.9.20 immediately if you are relying on yard server to host documentation in any untrusted environments.
Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration.

References:

https://github.com/lsegal/yard/security/advisories/GHSA-xfhh-rx56-rxcr
https://lists.debian.org/debian-lts-announce/2024/03/msg00006.html
Comment 1 Pedro Sampaio 2024-06-28 18:51:42 UTC 
Created rubygem-yard tracking bugs for this issue:

Affects: epel-all [bug 2294731]
Note You need to log in before you can comment on or make changes to this bug.