CVE-2014-0130

CVE-2014-0130 is a directory traversal vulnerability (CWE-22) in the implicit-render implementation of Ruby on Rails, located in actionpack's abstract_controller/base.rb. A remote attacker sends a crafted request that manipulates the template/render path, causing the application to resolve and render files outside the intended directory. Successful exploitation grants arbitrary file reads on the web server, potentially exposing application source code and configuration files containing secrets. Any Ruby on Rails deployment that relies on implicit rendering is affected, per CISA's listing of Ruby on Rails. The flaw is known to be exploited in the wild (added to CISA KEV on 2022-03-25), carries a high EPSS of 53.7% (99th percentile), and has no known public proof-of-concept; ransomware use is unknown.

What to do: Apply updated Rails releases per vendor instructions, as required by CISA's KEV listing for this vulnerability. Audit Rails controllers and code paths that depend on implicit rendering, and review access logs for crafted requests containing traversal sequences (../ or encoded equivalents). Where patching is delayed, render templates explicitly and restrict accepted formats and paths.