Directory Traversal Vulnerability in Ruby Package: CVE-2018-8780
Summary
ALPINE-CVE-2018-8780: In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir.open, Dir.new, Dir.entries and Dir.empty? Affects ruby versions < 2.5.1-r0. Fixed in 2.5.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ruby is a dynamic, open-source programming language with a focus on simplicity and productivity. It is widely used for web development, particularly with the Ruby on Rails framework. The Ruby package provides essential tools for developers to create applications efficiently. However, certain versions of Ruby are vulnerable to a directory traversal issue that can lead to unauthorized access to the file system.
Vulnerability Detail
In Ruby versions prior to 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the methods Dir.open, Dir.new, Dir.entries, and Dir.empty? do not properly validate NULL characters. This oversight can allow attackers to perform unintentional directory traversal, potentially exposing sensitive files and directories to unauthorized users. The vulnerability is classified with a CVSS score of 9.1, indicating a critical risk level.
How To Fix
Minimum fixed version
2.5.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade rubyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid using the affected methods (Dir.open, Dir.new, Dir.entries, and Dir.empty?) with untrusted input. Ensure that any directory paths are sanitized and validated before use.
Conclusion
CVE-2018-8780 represents a significant security risk for applications using vulnerable versions of Ruby. It is crucial for developers to update their Ruby installations to the patched versions to prevent potential directory traversal attacks. Additionally, employing best practices for input validation can help mitigate risks until updates can be applied.
See every vulnerability recorded for ruby →
FAQ
CVE-2018-8780 is a vulnerability in Ruby that allows for directory traversal due to improper handling of NULL characters in certain directory methods.
Affected versions include Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
If an immediate update is not possible, ensure that you sanitize and validate all directory paths used in your application to mitigate the risk of exploitation.
The CVSS score for CVE-2018-8780 is 9.1, indicating a critical level of risk associated with this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for ruby.
