CVE-2018-3760

This repository contains a working proof-of-concept exploit for CVE-2018-3760, a directory traversal vulnerability in Rails Asset Pipeline. The exploit leverages path normalization bypasses to access arbitrary files on the system, potentially leading to information disclosure or remote code execution if the file contains compilable extensions like .erb.

This PoC demonstrates a path traversal vulnerability in Sprockets (Ruby on Rails) versions 3.7.1 and below, allowing attackers to read arbitrary files on the server using double URL encoding techniques.

This PoC exploits CVE-2018-3760, an arbitrary file read vulnerability in Ruby on Rails. It uses double URL encoding to bypass path traversal restrictions and read sensitive files like /etc/passwd.