Immunity Canvas: RAILS_ACCEPT_READFILE

The vulnerability resides in Action View in combination with calls to ‘render file:’ in a controller.
You need to place in the corresponding textfield the path to the controller that uses ‘render file’
in a similar way to the code below:

class HelloController < ApplicationController
def index
render file: “#{Rails.root}/some/file”
end
end

Vulnerable Rails versions:

• < 5.2.2.1
• < 5.1.6.2
• < 5.0.7.2
• < 4.2.11.1

Tested on:

• Ubuntu 18.10, Rails 5.2.1

Repeatability: Infinite
References: https://groups.google.com/forum/#!topic/rubyonrails-security/pFRKI96Sm8Q
CVE Url: http://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-5418
Date public: 13/03/2019