Path Traversal Vulnerability in iodine RubyGem
Summary
CVE-2024-22050: Malicious URL drafting attack against iodines static file server may allow path traversal. Affects iodine versions < 0.7.34. Fixed in 0.7.34. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
iodine is a RubyGem that provides a static file server for applications. It allows serving static files and supports the X-Sendfile header for efficient file transfers. However, a path traversal vulnerability has been discovered in iodine's static file service.
Vulnerability Detail
The path traversal vulnerability in iodine's static file server allows an attacker to manipulate the URL and access files that should not be publicly accessible. By crafting a malicious URL, an attacker can trick the server into responding with sensitive data from files outside the intended public folder. This vulnerability affects all applications running iodine's static file server on affected versions.
How To Fix
Minimum fixed version
0.7.34
This is the first release that contains the fix.
gem install iodine -v 0.7.34Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading iodine is not immediately feasible, a possible workaround is to disable the static file service and its X-Sendfile support. Instead, static files can be served using a different server like nginx or by implementing a source code solution that dynamically sends the file data.
Conclusion
The path traversal vulnerability in iodine's static file server can be mitigated by upgrading to the latest version (0.7.34). If immediate upgrade is not possible, disabling the static file service and using an alternative server or source code solution can serve as a temporary workaround. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for iodine →
FAQ
The path traversal vulnerability allows an attacker to access sensitive files that should not be publicly accessible. This can lead to unauthorized disclosure of sensitive information.
Versions of iodine prior to 0.7.34 are affected by this vulnerability.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Disabling the static file service and using an alternative server or implementing a source code solution can serve as a temporary workaround until iodine is upgraded.
For more information, you can contact Boaz Segev via email at boazsegev@gmail.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for iodine.
