CVE-2016-3693: safemode gem allows context-dependent attackers to obtain sensitive information via the inspect method
8.1
CVSS Score
3.0
Basic Information
CVE ID
GHSA ID
EPSS Score
0.71792%
CWE
Published
10/24/2017
Updated
9/5/2023
KEV Status
No
Technology
Ruby
Technical Details
CVSS Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
---|---|---|---|
safemode | rubygems | < 1.2.4 | 1.2.4 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability stems from Safemode's Blankslate class explicitly allowing the 'inspect' method in both instance and class method whitelists. The commit diff shows 'inspect' was removed from both @@allow_instance_methods and @@allow_class_methods arrays in lib/safemode/blankslate.rb. Since Safemode delegates to Rails controllers, calling 'inspect' on these objects would leak sensitive application state. The patch directly addresses this by removing 'inspect' from allowed methods, confirming these were the vulnerable functions.