Staging Environment: Content and features may be unstable or change without notice.
Advisory details: ruby_advisory_db / gems/actionview/CVE-2016-0752
Advisory ID ruby_advisory_db/gems/actionview/CVE-2016-0752
Aliases CVE-2016-0752
GHSA-xrr4-p6fq-hjg7
Summary Possible Information Leak Vulnerability in Action View There is a possible directory traversal and information leak vulnerability in Action View. This vulnerability has been assigned the CVE identifier CVE-2016-0752. Versions Affected: All. Not affected: None. Fixed Versions: 5.0.0.beta1.1, 4.2.5.1, 4.1.14.1, 3.2.22.1 Impact ------ Applications that pass unverified user input to the `render` method in a controller may be vulnerable to an information leak vulnerability. Impacted code will look something like this: ```ruby def index render params[:id] end ``` Carefully crafted requests can cause the above code to render files from unexpected places like outside the application's view directory, and can possibly escalate this to a remote code execution attack. All users running an affected release should either upgrade or use one of the workarounds immediately. Releases -------- The FIXED releases are available at the normal locations. Workarounds ----------- A workaround to this issue is to not pass arbitrary user input to the `render` method. Instead, verify that data before passing it to the `render` method. For example, change this: ```ruby def index render params[:id] end ``` To this: ```ruby def index render verify_template(params[:id]) end private def verify_template(name) # add verification logic particular to your application here end ``` Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset. * 3-2-render_data_leak.patch - Patch for 3.2 series * 4-1-render_data_leak.patch - Patch for 4.1 series * 4-2-render_data_leak.patch - Patch for 4.2 series * 5-0-render_data_leak.patch - Patch for 5.0 series Please note that only the 4.1.x and 4.2.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases. Credits ------- Thanks John Poulin for reporting this!
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (0)
There are no known CWE.
System Score Found at
cvssv2 5.0
cvssv3 7.5
Reference id Reference type URL
https://groups.google.com/forum/#!topic/rubyonrails-security/335P1DcLG00
Data source KEV
Date added March 25, 2022
Description Directory traversal vulnerability in Action View in Ruby on Rails allows remote attackers to read arbitrary files.
Required action Apply updates per vendor instructions.
Due date April 15, 2022
Note 
https://nvd.nist.gov/vuln/detail/CVE-2016-0752
Ransomware campaign use Unknown
Data source Metasploit
Description This module exploits a remote code execution vulnerability in the explicit render method when leveraging user parameters. This module has been tested across multiple versions of Ruby on Rails. The technique used by this module requires the specified endpoint to be using dynamic render paths, such as the following example: def show render params[:id] end Also, the vulnerable target will need a POST endpoint for the TempFile upload, this can literally be any endpoint. This module doesnt use the log inclusion method of exploitation due to it not being universal enough. Instead, a new code injection technique was found and used whereby an attacker can upload temporary image files against any POST endpoint and use them for the inclusion attack. Finally, you only get one shot at this if you are testing with the builtin rails server, use caution.
Note 
Reliability:
  - unknown-reliability
Stability:
  - unknown-stability
SideEffects:
  - unknown-side-effects
Ransomware campaign use Unknown
Source publication date Oct. 16, 2016
Platform BSD,Linux
Source URL https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/http/rails_dynamic_render_code_exec.rb
Data source Exploit-DB
Date added Oct. 17, 2016
Description Ruby on Rails - Dynamic Render File Upload / Remote Code Execution (Metasploit)
Ransomware campaign use Known
Source publication date Oct. 17, 2016
Exploit type remote
Platform multiple
Source update date Oct. 25, 2016
Data source KEV
Date added March 25, 2022
Description Directory traversal vulnerability in Action View in Ruby on Rails allows remote attackers to read arbitrary files.
Required action Apply updates per vendor instructions.
Due date April 15, 2022
Note 
https://nvd.nist.gov/vuln/detail/CVE-2016-0752
Ransomware campaign use Unknown
Data source Metasploit
Description This module exploits a remote code execution vulnerability in the explicit render method when leveraging user parameters. This module has been tested across multiple versions of Ruby on Rails. The technique used by this module requires the specified endpoint to be using dynamic render paths, such as the following example: def show render params[:id] end Also, the vulnerable target will need a POST endpoint for the TempFile upload, this can literally be any endpoint. This module doesnt use the log inclusion method of exploitation due to it not being universal enough. Instead, a new code injection technique was found and used whereby an attacker can upload temporary image files against any POST endpoint and use them for the inclusion attack. Finally, you only get one shot at this if you are testing with the builtin rails server, use caution.
Note 
Reliability:
  - unknown-reliability
Stability:
  - unknown-stability
SideEffects:
  - unknown-side-effects
Ransomware campaign use Unknown
Source publication date Oct. 16, 2016
Platform BSD,Linux
Source URL https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/http/rails_dynamic_render_code_exec.rb
Data source Exploit-DB
Date added Oct. 17, 2016
Description Ruby on Rails - Dynamic Render File Upload / Remote Code Execution (Metasploit)
Ransomware campaign use Known
Source publication date Oct. 17, 2016
Exploit type remote
Platform multiple
Source update date Oct. 25, 2016

No EPSS data available for this advisory.

Patch URL
There are no known patches.

There are no known vectors.

Vector: SSVCv2/E:A/A:Y/T:P/P:M/B:A/M:M/D:A/2025-02-07T13:26:36Z/

Decision: Attend

Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2016/0xxx/CVE-2016-0752.json

Source Advisory: vulnrichment/CVE-2016-0752

View SSVC decision tree 
[{'Exploitation': 'active'},
 {'Automatable': 'yes'},
 {'Technical Impact': 'partial'},
 {'Mission Prevalence': 'minimal'},
 {'Public Well-being Impact': 'material'},
 {'Mission & Well-being': 'medium'}]