Vulnerabilities > CVE-2019-5418

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

low complexity

nessus

exploit available

metasploit

NVD

Published: 2019-03-27

Updated: 2023-11-07

Summary

There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.

Vulnerable Configurations

Part	Description	Count
Application	Rubyonrails Rubyonrails Rails 5.0.0 Rubyonrails Rails 5.0.0.1 Rubyonrails Rails 5.0.1 Rubyonrails Rails 5.0.2 Rubyonrails Rails 5.0.3 Rubyonrails Rails 5.0.4 Rubyonrails Rails 5.0.5 Rubyonrails Rails 5.0.6 Rubyonrails Rails 5.0.7 Rubyonrails Rails 5.0.7.1 Rubyonrails Rails 5.1.0 Rubyonrails Rails 5.1.1 Rubyonrails Rails 5.1.2 Rubyonrails Rails 5.1.3 Rubyonrails Rails 5.1.4 Rubyonrails Rails 5.1.5 Rubyonrails Rails 5.1.6 Rubyonrails Rails 5.1.6.1 Rubyonrails Rails 5.2.0 Rubyonrails Rails 5.2.1 Rubyonrails Rails 5.2.1.1 Rubyonrails Rails 5.2.2 Rubyonrails Rails 3.0.0 Rubyonrails Rails 3.0.1 Rubyonrails Rails 3.0.2 Rubyonrails Rails 3.0.3 Rubyonrails Rails 3.0.4 Rubyonrails Rails 3.0.5 Rubyonrails Rails 3.0.6 Rubyonrails Rails 3.0.7 Rubyonrails Rails 3.0.8 Rubyonrails Rails 3.0.9 Rubyonrails Rails 3.0.10 Rubyonrails Rails 3.0.11 Rubyonrails Rails 3.0.12 Rubyonrails Rails 3.0.13 Rubyonrails Rails 3.0.14 Rubyonrails Rails 3.0.15 Rubyonrails Rails 3.0.16 Rubyonrails Rails 3.0.17 Rubyonrails Rails 3.0.18 Rubyonrails Rails 3.0.19 Rubyonrails Rails 3.0.20 Rubyonrails Rails 3.1.0 Rubyonrails Rails 3.1.1 Rubyonrails Rails 3.1.2 Rubyonrails Rails 3.1.3 Rubyonrails Rails 3.1.4 Rubyonrails Rails 3.1.5 Rubyonrails Rails 3.1.6 Rubyonrails Rails 3.1.7 Rubyonrails Rails 3.1.8 Rubyonrails Rails 3.1.9 Rubyonrails Rails 3.1.10 Rubyonrails Rails 3.1.11 Rubyonrails Rails 3.1.12 Rubyonrails Rails 3.2.0 Rubyonrails Rails 3.2.1 Rubyonrails Rails 3.2.2 Rubyonrails Rails 3.2.3 Rubyonrails Rails 3.2.4 Rubyonrails Rails 3.2.5 Rubyonrails Rails 3.2.6 Rubyonrails Rails 3.2.7 Rubyonrails Rails 3.2.8 Rubyonrails Rails 3.2.9 Rubyonrails Rails 3.2.10 Rubyonrails Rails 3.2.11 Rubyonrails Rails 3.2.12 Rubyonrails Rails 3.2.13 Rubyonrails Rails 3.2.14 Rubyonrails Rails 3.2.15 Rubyonrails Rails 3.2.16 Rubyonrails Rails 3.2.17 Rubyonrails Rails 3.2.18 Rubyonrails Rails 3.2.19 Rubyonrails Rails 3.2.20 Rubyonrails Rails 3.2.21 Rubyonrails Rails 3.2.22 Rubyonrails Rails 3.2.22.1 Rubyonrails Rails 3.2.22.2 Rubyonrails Rails 3.2.22.3 Rubyonrails Rails 3.2.22.4 Rubyonrails Rails 3.2.22.5 Rubyonrails Rails 4.0.0 Rubyonrails Rails 4.0.1 Rubyonrails Rails 4.0.2 Rubyonrails Rails 4.0.3 Rubyonrails Rails 4.0.4 Rubyonrails Rails 4.0.5 Rubyonrails Rails 4.0.6 Rubyonrails Rails 4.0.7 Rubyonrails Rails 4.0.8 Rubyonrails Rails 4.0.9 Rubyonrails Rails 4.0.10 Rubyonrails Rails 4.0.11 Rubyonrails Rails 4.0.11.1 Rubyonrails Rails 4.0.12 Rubyonrails Rails 4.0.13 Rubyonrails Rails 4.1.0 Rubyonrails Rails 4.1.1 Rubyonrails Rails 4.1.2 Rubyonrails Rails 4.1.3 Rubyonrails Rails 4.1.4 Rubyonrails Rails 4.1.5 Rubyonrails Rails 4.1.6 Rubyonrails Rails 4.1.7 Rubyonrails Rails 4.1.7.1 Rubyonrails Rails 4.1.8 Rubyonrails Rails 4.1.9 Rubyonrails Rails 4.1.10 Rubyonrails Rails 4.1.11 Rubyonrails Rails 4.1.12 Rubyonrails Rails 4.1.13 Rubyonrails Rails 4.1.14 Rubyonrails Rails 4.1.14.1 Rubyonrails Rails 4.1.14.2 Rubyonrails Rails 4.1.15 Rubyonrails Rails 4.1.16 Rubyonrails Rails 4.2.0 Rubyonrails Rails 4.2.1 Rubyonrails Rails 4.2.2 Rubyonrails Rails 4.2.3 Rubyonrails Rails 4.2.4 Rubyonrails Rails 4.2.5 Rubyonrails Rails 4.2.5.1 Rubyonrails Rails 4.2.5.2 Rubyonrails Rails 4.2.6 Rubyonrails Rails 4.2.7 Rubyonrails Rails 4.2.7.1 Rubyonrails Rails 4.2.8 Rubyonrails Rails 4.2.9 Rubyonrails Rails 4.2.10 Rubyonrails Rails 4.2.11	286
Application	Redhat Redhat Cloudforms 4.7 Redhat Cloudforms 4.6 Redhat Software Collections 1.0	3
OS	Debian Debian Debian Linux 8.0	1
OS	Opensuse Opensuse Leap 15.0	1
OS	Fedoraproject Fedoraproject Fedora 30	1

D2sec

name	Rails File Disclosure
url	http://www.d2sec.com/exploits/rails_file_disclosure.html

Exploit-Db

file	exploits/multiple/webapps/46585.py
id	EDB-ID:46585
last seen	2019-03-21
modified	2019-03-21
platform	multiple
port
published	2019-03-21
reporter	Exploit-DB
source	https://www.exploit-db.com/download/46585
title	Rails 5.2.1 - Arbitrary File Content Disclosure
type	webapps

Metasploit

description	This module uses a path traversal vulnerability in Ruby on Rails versions =< 5.2.2 to read files on a target server.
id	MSF:AUXILIARY/GATHER/RAILS_DOUBLETAP_FILE_READ
last seen	2019-12-31
modified	2019-04-21
published	2019-03-28
references	https://hackerone.com/reports/473888 https://github.com/mpgn/Rails-doubletap-RCE https://groups.google.com/forum/#!topic/rubyonrails-security/pFRKI96Sm8Q https://chybeta.github.io/2019/03/16/Analysis-for%E3%80%90CVE-2019-5418%E3%80%91File-Content-Disclosure-on-Rails/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5418
reporter	Rapid7
source	https://github.com/rapid7/metasploit-framework/blob/master//modules/auxiliary/gather/rails_doubletap_file_read.rb
title	Ruby On Rails File Content Disclosure ('doubletap')

Nessus

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2019-1344.NASL
description	This update for rubygem-actionpack-5_1 fixes the following issues : Security issues fixed : - CVE-2019-5418: Fixed a file content disclosure vulnerability in Action View which could be exploited via specially crafted accept headers in combination with calls to render file (bsc#1129272). - CVE-2019-5419: Fixed a resource exhaustion issue in Action View which could make the server unable to process requests (bsc#1129271). This update was imported from the SUSE:SLE-15:Update update project.
last seen	2020-06-01
modified	2020-06-02
plugin id	124709
published	2019-05-09
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/124709
title	openSUSE Security Update : rubygem-actionpack-5_1 (openSUSE-2019-1344)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2019-0796.NASL
description	An update is now available for CloudForms Management Engine 5.10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components. Security Fix(es) : * rubygem-actionpack: render file directory traversal in Action View (CVE-2019-5418) * rubygem-actionpack: denial of service vulnerability in Action View (CVE-2019-5419) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes : This update fixes various bugs and adds enhancements. Documentation for these changes is available from the Release Notes document linked to in the References section.
last seen	2020-06-01
modified	2020-06-02
plugin id	127087
published	2019-07-26
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/127087
title	RHEL 7 : CloudForms (RHSA-2019:0796)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2019-1CFE24DB5C.NASL
description	Update Ruby on Rails to 5.2.3. Fixes CVE-2019-5418 CVE-2019-5419 CVE-2019-5420. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	124724
published	2019-05-10
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/124724
title	Fedora 30 : 1:rubygem-actionmailer / 1:rubygem-actionpack / etc (2019-1cfe24db5c)

NASL family	FreeBSD Local Security Checks
NASL id	FREEBSD_PKG_1396A74A499711E9B5F183EDB3F89BA1.NASL
description	Ruby on Rails blog : Rails 4.2.11.1, 5.0.7.2, 5.1.6.2, 5.2.2.1, and 6.0.0.beta3 have been released! These contain the following important security fixes. It is recommended that users upgrade as soon as possible : CVE-2019-5418 File Content Disclosure in Action View CVE-2019-5419 Denial of Service Vulnerability in Action View
last seen	2020-06-01
modified	2020-06-02
plugin id	122936
published	2019-03-19
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/122936
title	FreeBSD : Rails -- Action View vulnerabilities (1396a74a-4997-11e9-b5f1-83edb3f89ba1)

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DLA-1739.NASL
description	John Hawthorn of Github discovered a file content disclosure vulnerability in Rails, a ruby based web application framework. Specially crafted accept headers in combination with calls to `render file:` can cause arbitrary files on the target server to be rendered, disclosing the file contents. This vulnerability could also be exploited for a denial of service attack. For Debian 8
last seen	2020-06-01
modified	2020-06-02
plugin id	123526
published	2019-04-01
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/123526
title	Debian DLA-1739-1 : rails security update

Packetstorm

data source	https://packetstormsecurity.com/files/download/152178/rails521-disclose.txt
id	PACKETSTORM:152178
last seen	2019-03-22
published	2019-03-21
reporter	NotoriousRebel
source	https://packetstormsecurity.com/files/152178/Rails-5.2.1-Arbitrary-File-Content-Disclosure.html
title	Rails 5.2.1 Arbitrary File Content Disclosure

Redhat

advisories

rhsa
id RHSA-2019:0796
rhsa
id RHSA-2019:1147
rhsa
id RHSA-2019:1149
rhsa
id RHSA-2019:1289

rpms

ansible-tower-0:3.4.3-1.el7at
ansible-tower-server-0:3.4.3-1.el7at
ansible-tower-setup-0:3.4.3-1.el7at
ansible-tower-ui-0:3.4.3-1.el7at
ansible-tower-venv-ansible-0:3.4.3-1.el7at
ansible-tower-venv-tower-0:3.4.3-1.el7at
cfme-0:5.10.3.3-1.el7cf
cfme-amazon-smartstate-0:5.10.3.3-1.el7cf
cfme-appliance-0:5.10.3.3-1.el7cf
cfme-appliance-common-0:5.10.3.3-1.el7cf
cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf
cfme-appliance-tools-0:5.10.3.3-1.el7cf
cfme-debuginfo-0:5.10.3.3-1.el7cf
cfme-gemset-0:5.10.3.3-1.el7cf
cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf
rh-ror50-rubygem-actionpack-1:5.0.1-2.el6
rh-ror50-rubygem-actionpack-1:5.0.1-2.el7
rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6
rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7
rh-ror42-rubygem-actionpack-1:4.2.6-5.el6
rh-ror42-rubygem-actionpack-1:4.2.6-5.el7
rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6
rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7
cfme-0:5.9.9.3-1.el7cf
cfme-amazon-smartstate-0:5.9.9.3-1.el7cf
cfme-appliance-0:5.9.9.3-1.el7cf
cfme-appliance-common-0:5.9.9.3-1.el7cf
cfme-appliance-debuginfo-0:5.9.9.3-1.el7cf
cfme-appliance-tools-0:5.9.9.3-1.el7cf
cfme-debuginfo-0:5.9.9.3-1.el7cf
cfme-gemset-0:5.9.9.3-1.el7cf
cfme-gemset-debuginfo-0:5.9.9.3-1.el7cf

Vulnerabilities > CVE-2019-5418 {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Vulnerabilities","item":"https://cyber.vumetric.com/vulns/"},{"@type":"ListItem","position":2,"name":"CVE-2019-5418"}]}

Summary

Vulnerable Configurations

D2sec

Exploit-Db

Metasploit

Nessus

Packetstorm

Redhat

References

Vulnerabilities > CVE-2019-5418