Sprockets path traversal leads to information leak

Also known as GHSA-pr3h-jjhj-573x

Published 8 y ago 2018-06-20 · modified 4 mo ago 2026-06-17 · JSON

CVSS

7.5

v3.0 · NVD

CISA KEV

not known exploited

EPSS

26.3%

percentile 98%

Public exploits

none known · Nuclei check

There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately.

Exploit prediction (EPSS)

26.35% probability of exploitation in the next 30 days, higher than 98% of all scored CVEs.

Exploits and detections

Nuclei template Ruby On Rails - Local File Inclusion · nuclei detection template

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	7.5	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`
NVD	2.0	5.0	`AV:N/AC:L/Au:N/C:P/I:N/A:N`
GitHub	3.0	7.5	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
rubygems	`sprockets`	>=3.0.0, <3.7.2 >=4.0.0.beta1, <4.0.0.beta8 <2.12.5	3.7.2 4.0.0.beta8 2.12.5

Affected products

HackerOne Sprockets

Classification

Weakness

CWE-22 Improper Limitation of a Pathname to a Restricted Directory
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

github.com /rails/sprockets/commit/c09131cf5b2c479263939c8582e22b98ed616c5fhttps://github.com/rails/s · x_refsource_MISC, x_transferred
access.redhat.com /errata/RHSA-2018:2745 · vendor-advisory, x_refsource_REDHAT, x_transferred
groups.google.com /d/msg/rubyonrails-security/ft_J--l55fM/7roDfQ50BwAJ · x_refsource_MISC, x_transferred
access.redhat.com /errata/RHSA-2018:2244 · vendor-advisory, x_refsource_REDHAT, x_transferred
access.redhat.com /errata/RHSA-2018:2561 · vendor-advisory, x_refsource_REDHAT, x_transferred
access.redhat.com /errata/RHSA-2018:2245 · vendor-advisory, x_refsource_REDHAT, x_transferred
debian.org /security/2018/dsa-4242 · vendor-advisory, x_refsource_DEBIAN, x_transferred
nvd.nist.gov /vuln/detail/CVE-2018-3760 · advisory
github.com /rails/sprockets/commit/18b8a7f07a50c245e9aee7854ecdbe606bbd8bb5 · web
github.com /rails/sprockets/commit/9c34fa05900b968d74f08ccf40917848a7be9441 · web
github.com /rails/sprockets/commit/c09131cf5b2c479263939c8582e22b98ed616c5f · web
github.com /rails/sprockets · package

Sources

CVE List: CVE-2018-3760
GitHub Advisory: GHSA-pr3h-jjhj-573x
NVD: CVE-2018-3760

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary