CVE-2011-0449 actionpack allows remote attackers to bypass intended access restrictions
HighCVSS 7.5
EPSS 2.5%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not properly implement filters associated with the list of available templates, which allows remote attackers to bypass intended access restrictions via an action name that uses an unintended case for alphabetic characters.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems actionpack(RubyGems) | >= 3.0.0, < 3.0.4 | 3.0.4 |
| rubygems actionpack(RubyGems) | = 3.0.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.3 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.4.rc1 | No fix listed |
| rubyonrails rails | = 3.0.0 | No fix listed |
| rubyonrails rails | = 3.0.0-beta | No fix listed |
| rubyonrails rails | = 3.0.0-beta2 | No fix listed |
| rubyonrails rails | = 3.0.0-beta3 | No fix listed |
| rubyonrails rails | = 3.0.0-beta4 | No fix listed |
| rubyonrails rails | = 3.0.0-rc | No fix listed |
| rubyonrails rails | = 3.0.0-rc2 | No fix listed |
| rubyonrails rails | = 3.0.1 | No fix listed |
| rubyonrails rails | = 3.0.1-pre | No fix listed |
| rubyonrails rails | = 3.0.2 | No fix listed |
| rubyonrails rails | = 3.0.2-pre | No fix listed |
| rubyonrails rails | = 3.0.3 | No fix listed |
| rubyonrails rails | = 3.0.4-rc1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- [rubyonrails-security] 20110209 Filter Problems on Case-Insensitive Filesystems mailing-list
- FEDORA-2011-4358 vendor-advisory
- weblog.rubyonrails.org patch
- github.com patch
- github.com exploit
- web.archive.org
- github.com
- github.com product
- 43278 third-party-advisory vendor-advisory
- 1025061 vdb-entry
- ADV-2011-0877 vdb-entry
- Debian Security Tracker CVE-2011-0449 vendor-advisory