CVE-2018-3760: Sprockets path traversal leads to information leak
7.5
CVSS Score
3.0
Basic Information
CVE ID
GHSA ID
EPSS Score
0.99789%
CWE
Published
6/20/2018
Updated
9/5/2023
KEV Status
No
Technology
Ruby
RubyTechnical Details
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| sprockets | rubygems | < 2.12.5 | 2.12.5 |
| sprockets | rubygems | >= 3.0.0, < 3.7.2 | 3.7.2 |
| sprockets | rubygems | >= 4.0.0.beta1, <= 4.0.0.beta7 | 4.0.0.beta8 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from insufficient path validation in the Sprockets server. The commit 18b8a7f explicitly modifies the forbidden_request? method in lib/sprockets/server.rb to add a check for URI schemes (path.include?('://')). Prior to this fix, the function allowed requests with URI schemes like file://, enabling path traversal attacks. The added test case in test/test_server.rb demonstrates this by attempting to access a file:// URL, which would have been permitted without the patch. This function's flawed validation logic directly enabled the CVE-2018-3760 path traversal vulnerability.