CVE-2013-4413 (published 2014-03-11T19:37Z)

Directory traversal vulnerability in controller/concerns/render_redirect.rb in the Wicked gem before 1.0.1 for Ruby allows remote attackers to read arbitrary files via a %2E%2E%2F (encoded dot dot slash) in the step.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/schneems/wicked
commit_details: repo_url: https://github.com/schneems/wicked
author: schneems
author_date: 2013-10-08 12:03:12-05:00
msg: [close #94] Security Update

Prevent specially crafted url strings from being used to access unintended files via an escaped slash character `%2e`
repository: repo_url: https://github.com/schneems/wicked
repo_name: zombocom/wicked
description: Use wicked to turn your controller into a wizard
repo_language: Ruby
owner: schneems
file_changes: filename: CHANGELOG.md
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,7 @@
+## 1.0.1 (8/08/2013)
+
+* Fix security issue #94
+
 ## 1.0.0 (8/03/2013)
 
 * Rails 4 compatible tested version released

programming_language: Markdown
filename: VERSION
change_type: ModificationType.MODIFY
diff: @@ -1 +1 @@
-1.0.0
+1.0.1

programming_language: SQL
filename: wicked.rb
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,5 @@
+require 'erb'
+
 module Wicked
   FINISH_STEP = "wicked_finish"
   FIRST_STEP  = "wicked_first"

programming_language: Ruby
filename: render_redirect.rb
change_type: ModificationType.MODIFY
diff: @@ -26,7 +26,7 @@ module Wicked::Controller::Concerns::RenderRedirect
     if the_step.nil? || the_step.to_s == Wicked::FINISH_STEP
       redirect_to_finish_wizard options
     else
-      render the_step, options
+      render ERB::Util.url_encode(the_step), options
     end
   end
 

programming_language: Ruby
filename: security_test.rb
change_type: ModificationType.ADD
diff: @@ -0,0 +1,23 @@
+require 'test_helper'
+
+class SecurityTest < ActiveSupport::IntegrationCase
+
+  test 'does not show database.yml' do
+    step = "%2E%2F%2E%2E%2F%2E%2E%2Fconfig%2Fdatabase%2Eyml"
+    assert_raise ActionView::MissingTemplate do
+      visit(bar_path(step))
+    end
+    refute has_content?('sqlite3')
+  end
+
+  # only works on *nix systems
+  test 'does not show arbitrary system file' do
+    root = '%2E%2F%2E' * 100 # root of system
+    step = root + '%2Fusr%2Fshare%2Fdict%2Fwords'
+
+    assert_raise ActionView::MissingTemplate do
+      visit(bar_path(step))
+    end
+    refute has_content?('aardvark')
+  end
+end

programming_language: Ruby