CVE-2014-125033: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: A vulnerability was found in rails-cv-app. It has been rated as problematic. Affected by this issue is some unknown functionality of the file app/controllers/uploaded_files_controller.rb. The manipulation with the input ../../../etc/passwd leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. The patch is identified as 0d20362af0a5f8a126f67c77833868908484a863. It is recommended to apply a patch to fix this issue. VDB-217178 is the identifier assigned to this vulnerability.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.5
Published: 2023-01-02T08:15Z
Repository: https://github.com/bertrand-caron/rails-cv-app
Language: Ruby
Files changed: app/controllers/uploaded_files_controller.rb, spec/controllers/helpers_controller_spec.rb, spec/controllers/uploaded_file_spec.rb, spec/factories/uploaded_file.rb
Commit date: 2014-11-16 22:59:19 +0100
Commit message: HOTFIX : Another vulnerability picked up by Brakeman

- Potential Path Traversal attack (tested working !)
I could potentially explore the whole filesystem with root access
(Ex: filename: '../../../etc/passwd')
- Added (empty) specs to detect it

Diff: diff --git a/app/controllers/uploaded_files_controller.rb b/app/controllers/uploaded_files_controller.rb
index 9be6ca9..ebc5347 100644
--- a/app/controllers/uploaded_files_controller.rb
+++ b/app/controllers/uploaded_files_controller.rb
@@ -37,10 +37,15 @@ class UploadedFilesController < ApplicationController
 
     # Just to be sure, replace every whitespace with a '-'
     @uploaded_file.name.gsub!(/ /, '-')
 
     # Then write to file
+    # WARNING : File.open is definitely vulnerable to Path Traversal Attacks
+    # (https://www.owasp.org/index.php/Path_Traversal) 
+    # The following line should take care of it, by only taking the past part of the path (aka filename)
+    @uploaded_file.name = @uploaded_file.name.split(/\//)[-1]
+
     File.open(@uploaded_file.absolute_path, 'wb') do |file|
       file.write(uploaded_io.read)
     end
 
     respond_to do |format|
diff --git a/spec/controllers/helpers_controller_spec.rb b/spec/controllers/helpers_controller_spec.rb
index c8b0cf8..d7ac003 100644
--- a/spec/controllers/helpers_controller_spec.rb
+++ b/spec/controllers/helpers_controller_spec.rb
@@ -7,13 +7,13 @@ describe HelpersController, type: :controller do
       it 'redirects to root_path' do
         post 'html_renderer', content: '<div>Hello', format: :html
         expect(response).to redirect_to(root_url)
       end
     end
-    context 'with session cookie' do
-      it 'corrects incorrect HTML' do
-        post 'html_renderer', content: '<div>Hello', format: :html
-        expect(response.body).to eq('<div>Hello</div>')
-      end
-    end
+#    context 'with session cookie' do
+#      it 'corrects incorrect HTML' do
+#        post 'html_renderer', content: '<div>Hello', format: :html
+#        expect(response.body).to eq('<div>Hello</div>')
+#      end
+#    end
   end
 end
diff --git a/spec/controllers/uploaded_file_spec.rb b/spec/controllers/uploaded_file_spec.rb
new file mode 100644
index 0000000..04963d6
--- /dev/null
+++ b/spec/controllers/uploaded_file_spec.rb
@@ -0,0 +1,9 @@
+require 'spec_helper'
+
+describe UploadedFilesController, type: :controller do
+  it 'has a valid factory' do
+    expect( FactoryGirl.create(:uploaded_file)).to be_valid
+  end
+
+  it 'does not accept relative paths in file name'
+end
diff --git a/spec/factories/uploaded_file.rb b/spec/factories/uploaded_file.rb
new file mode 100644
index 0000000..1e99b2a
--- /dev/null
+++ b/spec/factories/uploaded_file.rb
@@ -0,0 +1,11 @@
+require 'faker'
+
+FactoryGirl.define do
+  factory :uploaded_file do |f|
+    f.name 'hello.png'
+  end
+
+  factory :dangerous_file, class: UploadedFile do |f|
+    f.name '../Hello.png'
+  end
+end

Vulnerable code:     context 'with session cookie' do
      it 'corrects incorrect HTML' do
        post 'html_renderer', content: '<div>Hello', format: :html
        expect(response.body).to eq('<div>Hello</div>')
      end
    end
Fixed code:     # WARNING : File.open is definitely vulnerable to Path Traversal Attacks
    # (https://www.owasp.org/index.php/Path_Traversal) 
    # The following line should take care of it, by only taking the past part of the path (aka filename)
    @uploaded_file.name = @uploaded_file.name.split(/\//)[-1]

#    context 'with session cookie' do
#      it 'corrects incorrect HTML' do
#        post 'html_renderer', content: '<div>Hello', format: :html
#        expect(response.body).to eq('<div>Hello</div>')
#      end
#    end
require 'spec_helper'

describe UploadedFilesController, type: :controller do
  it 'has a valid factory' do
    expect( FactoryGirl.create(:uploaded_file)).to be_valid
  end

  it 'does not accept relative paths in file name'
end
require 'faker'

FactoryGirl.define do
  factory :uploaded_file do |f|
    f.name 'hello.png'
  end

  factory :dangerous_file, class: UploadedFile do |f|
    f.name '../Hello.png'
  end
end