Skip to content
OpenAdvisories
High · 7.5 Scanner template Public exploit CVE-2018-3760 EUVD-2018-0198GHSA-pr3h-jjhj-573x

Sprockets path traversal leads to information leak

Published Jun 26, 2018 · Updated Sep 16, 2024 · Assigned by hackerone

Vendor: HackerOne Product: Sprockets Package: ruby-sprockets Package: ruby-sprockets Package: sprockets Ecosystem: Debian Ecosystem: RubyGems Ecosystem: Ubuntu

Description

There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted requests can be used to access files that exists on the filesystem that is outside an application's root directory, when the Sprockets server is used in production. All users running an affected release should either upgrade or use one of the work arounds immediately.

Affected products

VendorProductAffectedFixed
HackerOne Sprockets 4.0.0.beta8, 3.7.2, 2.12.5 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 ruby-sprockets 3.7.0-1.1 —
Debian 13 ruby-sprockets 3.7.0-1.1 —
Debian 12 ruby-sprockets 3.7.0-1.1 —
Debian 9 ruby-sprockets 3.7.0-1+deb9u1 DSA-4242-1
Debian 8 ruby-sprockets 2.12.3-1+deb8u1 DLA-1419-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS ruby-sprockets 3.7.0-1+deb9u1build0.18.04.1 —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 16.04 LTS ruby-sprockets 3.3.0-1ubuntu0.1~esm1 USN-8990-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 3 rh-ror42-rubygem-sprockets +1 3.2.0-5.el6 RHSA-2018:2244
RHEL 3 rh-ror50-rubygem-sprockets +1 3.7.1-2.el6 RHSA-2018:2245
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat CloudForms 5 ansible-tower-setup +1 3.1.8-1.el7at RHSA-2018:2745
Red Hat CloudForms 5 cfme +2 5.8.5.1-1.el7cf RHSA-2018:2745, RHSA-2018:2561
Red Hat CloudForms 5 cfme-appliance-tools +2 5.9.4.7-1.el7cf RHSA-2018:2561
Red Hat CloudForms 5 rh-postgresql95-postgresql-pglogical 1.2.1-2.el7cf RHSA-2018:2745, RHSA-2018:2561
Red Hat CloudForms 5 rh-ruby23-rubygem-redhat_access_cfme +1 2.0.3-1.el7cf RHSA-2018:2561

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 rubygem-sprockets 3.7.2-3.3.1 SUSE-SU-2018:1994-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SUSE OpenStack Cloud Crowbar 8 crowbar 5.0+git.1528696845.81a7b5d0-3.3.1 SUSE-SU-2018:2762-1
SUSE OpenStack Cloud Crowbar 8 crowbar-core 5.0+git.1533887407.6e9b0412d-3.8.2 SUSE-SU-2018:2762-1
SUSE OpenStack Cloud Crowbar 8 crowbar-ha 5.0+git.1530177874.35b9099-3.3.1 SUSE-SU-2018:2762-1
SUSE OpenStack Cloud Crowbar 8 crowbar-init 5.0+git.1520420379.d5bbb35-3.3.1 SUSE-SU-2018:2762-1
SUSE OpenStack Cloud Crowbar 8 crowbar-openstack 5.0+git.1534167599.d325ef804-4.8.2 SUSE-SU-2018:2762-1
SUSE OpenStack Cloud Crowbar 8 crowbar-ui 1.2.0+git.1533844061.4ac8e723-3.3.1 SUSE-SU-2018:2762-1
SUSE OpenStack Cloud Crowbar 8 rubygem-sprockets-2_12 2.12.5-1.4.1 SUSE-SU-2018:2176-1
SUSE OpenStack Cloud 7 crowbar 4.0+git.1528801103.f5708341-7.20.1 SUSE-SU-2018:2603-1
SUSE OpenStack Cloud 7 crowbar-core 4.0+git.1534246408.3ab19c567-9.33.1 SUSE-SU-2018:2603-1
SUSE OpenStack Cloud 7 crowbar-ha 4.0+git.1533750802.5768e73-4.34.1 SUSE-SU-2018:2603-1
SUSE OpenStack Cloud 7 crowbar-openstack 4.0+git.1534254269.ce598a9fe-9.39.1 SUSE-SU-2018:2603-1
SUSE OpenStack Cloud 7 crowbar-ui 1.1.0+git.1533844061.4ac8e723-4.3.1 SUSE-SU-2018:2603-1
SUSE OpenStack Cloud 7 rubygem-sprockets-2_12 2.12.5-1.3.1 SUSE-SU-2018:2217-1
SUSE Enterprise Storage 4 crowbar 4.0+git.1528801103.f5708341-7.20.1 SUSE-SU-2018:2603-1
SUSE Enterprise Storage 4 crowbar-core 4.0+git.1534246408.3ab19c567-9.33.1 SUSE-SU-2018:2603-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed ruby3.2-rubygem-sprockets 4.1.1-1.6 openSUSE-SU-2024:13169-1
openSUSE Tumbleweed ruby3.2-rubygem-sprockets-3.7 3.7.2-1.20 openSUSE-SU-2024:13170-1
openSUSE Tumbleweed rubygem-sprockets 4.0.3-1.1 openSUSE-SU-2026:10364-1, openSUSE-SU-2025:15127-1, openSUSE-SU-2024:14177-1
openSUSE Tumbleweed rubygem-sprockets-3.7 3.7.3-1.1 openSUSE-SU-2026:10365-1, openSUSE-SU-2025:15128-1, openSUSE-SU-2024:14075-1

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 4 repositories

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

Affected packages

EcosystemPackageAffectedFixedRecord
RubyGems sprockets >= 3.0.0, < 3.7.2 3.7.2 GHSA-pr3h-jjhj-573x
RubyGems sprockets >= 4.0.0.beta1, < 4.0.0.beta8 4.0.0.beta8 GHSA-pr3h-jjhj-573x
RubyGems sprockets < 2.12.5 2.12.5 GHSA-pr3h-jjhj-573x

Advisories 22

References