.. / CVE-2019-5418

Exploit for Rails File Content Disclosure (CVE-2019-5418)

Description:

Rails <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 are susceptible to a file content disclosure vulnerability because specially crafted accept headers can cause contents of arbitrary files on the target system’s file system to be exposed.

Nuclei Template

View the template here CVE-2019-5418.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2019/CVE-2019-5418.yaml
Copy

References:

https://nvd.nist.gov/vuln/detail/CVE-2019-5418
https://github.com/omarkurt/CVE-2019-5418
https://www.exploit-db.com/exploits/46585/
https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00011.html