actionview contains Path Traversal vulnerability (GHSA-vx9j-46rh-fqr8)
Published: 2017-10-24T18:33:35Z
Aliases: CVE-2016-2097
Severity: MODERATE · CWE: CWE-22

There is a possible directory traversal and information leak vulnerability in Action View. This was meant to be fixed on CVE-2016-0752. However the 3.2 patch was not covering all possible scenarios. This vulnerability has been assigned the CVE identifier CVE-2016-2097.

Versions Affected:  3.2.x, 4.0.x, 4.1.x
Not affected:       4.2+
Fixed Versions:     3.2.22.2, 4.1.14.2

Impact
------
Applications that pass unverified user input to the `render` method in a controller may be vulnerable to an information leak vulnerability.

Impacted code will look something like this:

```ruby
def index
  render params[:id]
end
```

Carefully crafted requests can cause the above code to render files from unexpected places like outside the application's view directory, and can possibly escalate this to a remote code execution attack.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases
--------
The FIXED releases are available at the normal locations.

Workarounds
-----------
A workaround to this issue is to not pass arbitrary user input to the `render` method. Instead, verify that data before passing it to the `render` method.

For example, change this:

```ruby
def index
  render params[:id]
end
```

To this:

```ruby
def index
  render verify_template(params[:id])
end

private
def verify_template(name)
  # add verification logic particular to your application here
end
```

Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for it. It is in git-am format and consist of a single changeset.

* 3-2-render_data_leak_2.patch - Patch for 3.2 series
* 4-1-render_data_leak_2.patch - Patch for 4.1 series

Credits
-------
Thanks to both Jyoti Singh and Tobias Kraze from makandra for reporting this and working with us in the patch!

Affected packages:
package: ecosystem: RubyGems
name: actionview
ranges: type: ECOSYSTEM
events: introduced: 3.0.0
fixed: 3.2.22.2
database_specific: last_known_affected_version_range: <= 3.2.22.1
package: ecosystem: RubyGems
name: actionview
ranges: type: ECOSYSTEM
events: introduced: 4.0.0
fixed: 4.1.14.2
database_specific: last_known_affected_version_range: <= 4.1.14.1
package: ecosystem: RubyGems
name: actionpack
ranges: type: ECOSYSTEM
events: introduced: 3.0.0
fixed: 3.2.22.2
database_specific: last_known_affected_version_range: <= 3.2.22.1
package: ecosystem: RubyGems
name: actionpack
ranges: type: ECOSYSTEM
events: introduced: 4.0.0
fixed: 4.1.14.2
database_specific: last_known_affected_version_range: <= 4.1.14.1