There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.

Affected: RubyGems: actionview

# File Content Disclosure in Action View

Impact ------ There is a possible file content disclosure vulnerability in Action View. Specially crafted accept headers in combination with calls to `render file:` can cause arbitrary files on the target server to be rendered, disclosing the file contents.

The impact is limited to calls to `render` which render file contents without a specified accept format. Impacted code in a controller looks something like this:

``` ruby class UserController < ApplicationController def index render file: "#{Rails.root}/some/file" end end ```

Rendering templates as opposed to files is not impacted by this vulnerability.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases -------- The 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, and 4.2.11.1 releases are available at the normal locations.

Workarounds ----------- This vulnerability can be mitigated by specifying a format for file rendering, like this:

``` ruby class UserController < ApplicationController def index render file: "#{Rails.root}/some/file", formats: [:html] end end ```

In summary, impacted calls to `render` look like this:

``` render file: "#{Rails.root}/some/file" ```

The vulnerability can be mitigated by changing to this:

``` render file: "#{Rails.root}/some/file", formats: [:html] ```

Other calls to `render` are not impacted.

Alternatively, the following monkey pa…

Security update for rubygem-actionpack-5_1

Tower: credentials leaked through environment variables rubygem-actionpack: render file directory traversal in Action View rubygem-actionpack: denial of service vulnerability in Action View

Security update for rubygem-actionpack-4_2

Affected: Ubuntu:Pro:16.04:LTS: rails, Ubuntu:Pro:18.04:LTS: rails

There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.

Ein Angreifer kann mehrere Schwachstellen in Ruby on Rails ausnutzen, um Informationen offenzulegen, einen Denial of Service Zustand hervorzurufen oder beliebigen Programmcode auszuführen.