Redhat Cloudforms < 2.12.4 - Information Disclosure
Title source: ruleExploitation Summary
CVE-2018-3760 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 4 public exploits from researchers including mpgn, cyberharsh, dyeat. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a working proof-of-concept exploit for CVE-2018-3760, a directory traversal vulnerability in Rails Asset Pipeline. The exploit leverages path normalization bypasses to access arbitrary files on the system, potentially leading to information disclosure or remote code execution if the file contains compilable extensions like .erb.
Description
There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately.
Exploits (4)
This repository contains a working proof-of-concept exploit for CVE-2018-3760, a directory traversal vulnerability in Rails Asset Pipeline. The exploit leverages path normalization bypasses to access arbitrary files on the system, potentially leading to information disclosure or remote code execution if the file contains compilable extensions like .erb.
This PoC demonstrates a path traversal vulnerability in Sprockets (Ruby on Rails) versions 3.7.1 and below, allowing attackers to read arbitrary files on the server using double URL encoding techniques.
This repository contains a functional Python script that exploits CVE-2018-3760, a path traversal vulnerability in Ruby on Rails Sprockets 3.x. The script sends a crafted HTTP request with encoded '..' sequences to read arbitrary files (e.g., /etc/passwd) from the target system.
This PoC exploits CVE-2018-3760, an arbitrary file read vulnerability in Ruby on Rails. It uses double URL encoding to bypass path traversal restrictions and read sensitive files like /etc/passwd.
Nuclei Templates (1)
References (7)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N