.. / CVE-2018-3760

Exploit for Ruby On Rails - Local File Inclusion (CVE-2018-3760)

Description:

Ruby On Rails is vulnerable to local file inclusion caused by secondary decoding in Sprockets 3.7.1 and lower versions. An attacker can use %252e%252e/ to access the root directory and read or execute any file on the target server.

Nuclei Template

View the template here CVE-2018-3760.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2018/CVE-2018-3760.yaml
Copy

References:

https://nvd.nist.gov/vuln/detail/CVE-2018-3760
https://github.com/vulhub/vulhub/tree/master/rails/CVE-2018-3760
https://xz.aliyun.com/t/2542
https://i.blackhat.com/us-18/Wed-August-8/us-18-Orange-Tsai-Breaking-Parser-Logic-Take-Your-Path-Normalization-Off-And-Pop-0days-Out-2.pdf
https://seclists.org/oss-sec/2018/q2/210