漏洞描述
这个漏洞主要是由于网站使用了为指定参数的renderfile来渲染应用之外的视图，我们可以通过修改访问某控制器的请求包，通过../../../../来达到路径穿越的目的，然后再通过{{来进行模板查询路径的闭合，使得所要访问的文件被当做外部模板来解析。
Ruby on Rails 路径穿越与任意文件读取漏洞(CVE-2019-5418)
PoC代码
暂无相关漏洞推荐
- POC CVE-2015-3224: Ruby on Rails Web Console - Remote Code Execution
- POC CVE-2018-3760: Ruby On Rails - Local File Inclusion
- POC CVE-2019-5418: Rails File Content Disclosure
- POC CVE-2020-8163: Ruby on Rails <5.0.1 - Remote Code Execution
- POC CVE-2021-33564: Ruby Dragonfly <1.4.0 - Remote Code Execution
- POC CVE-2018-3760: Ruby On Rails Path Traversal
- POC CVE-2019-5418: Rails File Content Disclosure
- POC privesc-ruby: Ruby - Privilege Escalation
- POC cmdi-ruby-open-rce: Ruby Kernel#open/URI.open RCE
- POC ruby-on-rails-framework-exceptions: Ruby on Rails Framework Exceptions
- POC rails-database-config: Ruby on Rails Database Configuration File - Detect
- POC environment-rb: Environment Ruby File Disclosure
- POC rails-secret-token-disclosure: Ruby on Rails Secret Token Disclosure