How to recognize CVE-2019-5418

Posted Almost 5 years ago. Visible to the public.

If you get requests with values for formats like this:

{:locale=>[:de], :formats=>["../../../../../../../../../../etc/services{{"], :variants=>[], :handlers=>[:erb, :builder, :raw, :ruby, :coffee, :haml]}

or fails like this:

Invalid query parameters: invalid %-encoding (../../../../../../../../../etc/passwd%%0000.html)

Someone tries to exploit CVE-2019-5418 Show archive.org snapshot .
If you use the latest Rails (or latest Rails LTS Show archive.org snapshot ) you're safe. The exact versions that fix this issue are: Rails 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, 4.2.11.1, Rails LTS 3.2.22.13 and Rails LTS 2.3.18.24.

Last edit
Almost 5 years ago
Henning Koch
License
Source code in this card is licensed under the MIT License.

Related cards:

Customize tokenization of the MySQL FULLTEXT parser

The way MySQL's FULLTEXT tokenizer splits text into word tokens might not always be what you need. E.g. it splits a word at period characters.

Since the tokenizer has near-zero configuration options (minimum word length and stopwords list), you n...

How to make Rational#to_s return strings without denominator 1 again

The way Rational#to_s works on Ruby has changed from Ruby 1.9 on. Here is how to get the old behavior back.

You may want this for things where Rationals are being used, like when subtracting Date objects from one another.

What's happening?...

Invoices: How to properly round and calculate totals

While it might seem trivial to implement an invoice that sums up items and shows net, gross and vat totals, it actually involves a lot of rules and caveats. It is very easy to create invoices where numbers don't add up and a few cents are missing....

When sessions, cookies and Clearance tokens expire and how to change it

Expiration of Rails sessions

By default Rails sessions expire when the user closes her browser window.

To change this edit your config/initializers/session_store.rb like this:

ActionController::Base.session = ...

How to fix: "unexpected token" error for JSON.parse

When using the json gem, you might run into this error when using JSON.parse:

>> json = 'foo'.to_json
>> JSON.parse(json)
JSON::ParserError: 757: unexpected token at '"foo"'
	from /.../gems/json-...

Yarn: How to recognize that you are using a different node version than your colleagues

The issue in this card can occur if the node_modules directory is checked into your Git repository. We usually recommend to exclude node_modules from version control.

In any case you should document which version of node to use in your pr...

How to fix: Unable to read files from a VirtualBox shared host folder

When you want to copy/move from a shared folder (on Windows guests, for example) and it fails with absurd error messages (lots of text or an error about the target being read-only), you are probably running on Guest Additions that no longer match ...

How to fix: VirtualBox Guest Additions setup is out of date

When you are trying to install/update VirtualBox Guest Additions on your guest machine but the setup is for a different/older version (for example 4.0.4 tools for a 4.1.x VirtualBox installation), try this:

sudo apt-get install virtualbox-gue...

How to: Upgrade CarrierWave to 3.x

While upgrading CarrierWave from version 0.11.x to 3.x, we encountered some very nasty fails. Below are the basic changes you need to perform and some behavior you may eventually run into when upgrading your application. This aims to save you some...

How to fix: Microphone recording levels are too quiet (or get lowered automatically)

If others on a call (Skype, SIP, ...) can not hear you loud enough, your volume levels are probably too low. Also, Skype may be changing your mixer levels.

Set a proper recording volume

  1. Open your mixer software (run pavucontrol).
  2. Switc...
Posted to makandra dev (2019-05-29 07:25)
This website uses short-lived cookies to improve usability.
or learn more