vulnwire
4.7med

CVE-2017-16355

Phusion Passenger information disclosure

Also known as GHSA-cv3f-px9r-54hm

Published 8 y ago · modified 4 mo ago · JSON

CVSS
4.7
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
0.4%
percentile 30%
Public exploits
0
none known

In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if Passenger is running as root, it is possible to list the contents of arbitrary files on a system by symlinking a file named REVISION from the application root folder to a file of choice and querying passenger-status --show=xml.

Exploit prediction (EPSS)

0.36% probability of exploitation in the next 30 days, higher than 30% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.14.7CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD2.01.2AV:L/AC:H/Au:N/C:P/I:N/A:N
GitHub3.14.7CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected packages

EcosystemPackageAffectedFixed in
rubygemspassenger
<5.1.11
5.1.11

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

  • blog.phusion.nl /2017/10/13/passenger-security-advisory-5-1-11/ · x_refsource_CONFIRM, x_transferred
  • github.com /phusion/passenger/commit/4043718264095cde6623c2cbe8c644541036d7bf · x_refsource_CONFIRM, x_transferred
  • debian.org /security/2019/dsa-4415 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • seclists.org /bugtraq/2019/Mar/34 · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2017-16355 · advisory
  • blog.phusion.nl /2017/10/13/passenger-security-advisory-5-1-11 · web
  • github.com /phusion/passenger · web
  • github.com /rubysec/ruby-advisory-db/blob/master/gems/passenger/CVE-2017-16355.yml · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.