Arbitrary Path Traversal Vulnerability in YARD Package
Summary
GHSA-3jfp-46x4-xgfj: yard: Possible arbitrary path traversal and file access via yard server. Affects yard versions < 0.9.42. Fixed in 0.9.42. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
YARD is a documentation generation tool for Ruby that allows developers to create and serve documentation for their codebases. It is widely used in the Ruby community for its ability to generate clear and comprehensive documentation. However, versions of YARD up to 0.9.41 contain a vulnerability that can lead to arbitrary file access when using the yard server feature, particularly in untrusted environments.
Vulnerability Detail
A path traversal vulnerability was identified in YARD versions 0.9.41 and earlier. This vulnerability arises from the improper handling of unsanitized HTTP requests, which can allow an attacker to access arbitrary files on the server hosting the yard server. The issue was due to an incorrectly applied patch from a previous advisory, making it critical for users to be aware of the potential risks associated with serving documentation using YARD in insecure environments.
How To Fix
Minimum fixed version
0.9.42
This is the first release that contains the fix.
gem install yard -v 0.9.42Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not feasible, users can implement path sanitization at the web server level. For instance, if using WEBrick, you can run the yard server with the following command to enable default sanitization: 'yard server -s webrick'. Additionally, you may configure your web server to enforce strict rules regarding file access.
Conclusion
The path traversal vulnerability in YARD versions up to 0.9.41 poses a significant risk for users relying on the yard server feature. It is crucial to upgrade to version 0.9.42 or implement appropriate workarounds to safeguard your documentation and server environment. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for yard →
FAQ
A path traversal vulnerability allows an attacker to access files and directories that are stored outside the intended directory, potentially exposing sensitive information.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring any signup.
Failing to address this vulnerability could lead to unauthorized access to sensitive files on your server, potentially compromising your application and its data.
Yes, you can implement path sanitization at your web server level to mitigate the risk until you are able to upgrade to a secure version.
The CVSS score for this vulnerability is 6.9, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for yard.
