Intel

CVE-2016-0752

Rails Ruby on Rails — Ruby on Rails Directory Traversal Vulnerability

criticalKEV: actively exploitedPoCEPSS 96%

Description

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.

Source: CISA_KEVCVEORGCVELISTV5OSV

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2016-0752 carries an EPSS score of 95.54 % (99.9th percentile), reflecting a very high empirical exploitation probability — and its 2022 addition to the CISA KEV list confirms active targeting of real-world systems despite the vulnerability's age. The attack requires no authentication and no complex preconditions: any Rails application that passes user input directly to render is fully exposed, enabling an unauthenticated attacker to read arbitrary files including database credentials, private keys, and environment variables. For NIS2-regulated organisations, the confidentiality impact is severe wherever Rails applications are internet-facing or manage privileged credentials for critical systems; P1 prioritisation is warranted in those scenarios, with P2 appropriate for internal-only deployments that are still reachable from untrusted network segments.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply the vendor patch immediately: Upgrade Ruby on Rails to 3.2.22.1, 4.1.14.1, 4.2.5.1, or 5.0.0.beta1.1 depending on your branch. Run bundle update rails actionview and redeploy through your pipeline.
  • Inventory all affected instances: Identify every production system running actionview 4.0.x, 4.1.x (before 4.1.14.1), or 4.2.x (before 4.2.5.1) — check CI/CD logs and servers with bundle list | grep actionview.
  • Lock down uncontrolled render calls: Audit the codebase for any render params[:template] or equivalent pattern where user-supplied input reaches the render method without validation. Treat each occurrence as a critical finding and replace with an allowlist check before the patch lands.
  • Activate WAF blocking rules: Block or quarantine inbound HTTP requests containing .., %2e%2e, or %252e%252e in path or parameter fields at the WAF or reverse proxy (nginx/Apache) layer.
  • Review the last 90 days of access logs: Scan web server logs for path-traversal patterns (see Detection rules below) to determine whether exploitation has already occurred.

Runbook · Step 2

Mitigation layers

  • Network segmentation: Ensure Rails application servers sit behind a reverse proxy that forwards only explicitly defined HTTP methods and paths; no direct internet exposure without a protective layer in front.
  • WAF/IPS signature: Enable ModSecurity with OWASP CRS rule ID 930110 ("Path Traversal Attack"). Alternatively, deploy a Snort/Suricata rule combining content:"../"; http_uri; and content:"%2e%2e"; http_uri;.
  • Allowlist for render parameters: Introduce an explicit allowlist of permitted template names in application code — never pass request parameters directly to render. Deploy this as a hotfix even if the gem upgrade is still pending.
  • Filesystem hardening: Restrict the OS user running the Rails process to the minimum required read permissions — no access to /etc, /var/log, SSH keys, or credential stores. Enforce an AppArmor or SELinux profile for the process.
  • Rotate secrets: If prior exploitation cannot be ruled out, treat all secrets stored in the application environment (database credentials, API keys, secret_key_base) as compromised and rotate them immediately.

Runbook · Step 3

Detection rules

  • Web server access log (nginx/Apache): Match \.\./, %2e%2e, or %252e%252e in request paths or parameters — SPL: index=web sourcetype=access_combined | regex _raw="(\.\./|%2e%2e|%252e%252e)".
  • Rails application log: Entries containing ActionView::MissingTemplate or template paths resolving outside the views/ directory indicate failed or successful traversal attempts.
  • Linux auditd: Monitor file opens by the Rails process against sensitive paths — rule: -a always,exit -F arch=b64 -S open,openat -F path=/etc/passwd -F key=traversal_attempt; repeat for /etc/shadow, .env, database.yml.
  • Sigma rule (shape): title: Rails Path Traversal CVE-2016-0752 | logsource: category: webserver | detection: keywords: ['../','%2e%2e','%252e%252e'] | condition: keywords.
  • EDR/process telemetry: Flag child processes of Rails/Puma/Unicorn that open files outside the application directory or spawn shells (bash, sh, curl, wget as direct children) as high-severity alerts.

Metrics

Severity
critical
Priority score
161.07
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
—
CVSS v3
—
CVSS v4
—
EPSS percentile
99.9 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
95.5 %
High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
Published
2022-03-25 00:00 UTC
CWE
—

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • rubygems

    actionpack0.9.0

  • rubygems

    actionpack0.9.5

  • rubygems

    actionpack1.0.0

  • rubygems

    actionpack1.0.1

  • rubygems

    actionpack1.1.0

  • rubygems

    actionpack1.10.1

  • rubygems

    actionpack1.10.2

  • rubygems

    actionpack1.11.0

  • rubygems

    actionpack1.11.1

  • rubygems

    actionpack1.11.2

  • rubygems

    actionpack1.12.0

  • rubygems

    actionpack1.12.1

  • rubygems

    actionpack1.12.2

  • rubygems

    actionpack1.12.3

  • rubygems

    actionpack1.12.4

  • rubygems

    actionpack1.12.5

  • rubygems

    actionpack1.13.0

  • rubygems

    actionpack1.13.1

  • rubygems

    actionpack1.13.2

  • rubygems

    actionpack1.13.3

  • rubygems

    actionpack1.13.4

  • rubygems

    actionpack1.13.5

  • rubygems

    actionpack1.13.6

  • rubygems

    actionpack1.2.0

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

IDCVE-2016-0752