Rails Asset Pipeline Directory Traversal Vulnerability (CVE-2018-3760)

Summary

All previously released versions of Sprockets, which powers the Rails asset pipeline, contained a directory traversal vulnerability, CVE-2018-3760. Rails applications were vulnerable when production runtime asset compilation was enabled with config.assets.compile = true; the default production setting was false, so apps using the default were not vulnerable. Sprockets handled requests by searching for rendered assets and compiling matches dynamically, and an attacker could exploit that process with a crafted URL based on a known absolute source-asset path to make it appear inside a permitted path. Patches were prepared for Sprockets versions 2, 3, and 4, with remediation via disabling runtime compilation or upgrading to versions 2.12.5, 3.7.2, or 4.0.0.beta8. Heroku also updated its Ruby Buildpack to fail affected builds, notified customers, and warned that compromised applications may require credential rotation.

Takeaways

1. 1

   Applications with config.assets.compile = true in production were vulnerable; Rails production environments defaulted this setting to false.

2. 2

   Sprockets versions 2.12.5, 3.7.2, and 4.0.0.beta8 were identified as patched release targets.

3. 3

   A targeted application may have exposed repository secrets or environment variables, prompting precautionary rotation of database and other credentials.