Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.from_xml (Hash#from_xml) method, which uses XmlSimple (XML::Simple) unsafely, as demonstrated by reading passwords from the Pidgin (Gaim) .purple/accounts.xml file.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to
    determine the existence of arbitrary files and read arbitrary XML files via the Hash.from_xml
    (Hash#from_xml) method, which uses XmlSimple (XML::Simple) unsafely, as demonstrated by reading passwords
    from the Pidgin (Gaim) .purple/accounts.xml file. (CVE-2007-5379)

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have Security Update 2007-009 applied. 

This update contains several security fixes for a large number of programs.

The remote host is affected by the vulnerability described in GLSA-200711-17 (Ruby on Rails: Multiple vulnerabilities)

    candlerb found that ActiveResource, when processing responses using the     Hash.from_xml() function, does not properly sanitize filenames     (CVE-2007-5380). The session management functionality allowed the     'session_id' to be set in the URL (CVE-2007-5380). BCC discovered that     the to_json() function does not properly sanitize input before     returning it to the user (CVE-2007-3227).
  Impact :

    Unauthenticated remote attackers could exploit these vulnerabilities to     determine the existence of files or to read the contents of arbitrary     XML files; conduct session fixation attacks and gain unauthorized     access; and to execute arbitrary HTML and script code in a user's     browser session in context of an affected site by enticing a user to     browse a specially crafted URL.
  Workaround :

    There is no known workaround at this time.

A cross site scripting (XSS) bug allowed attackers to execute JavaScript code in the context of other websites (CVE-2007-3227).

Specially crafted requests could crash an application when processing XML data (CVE-2007-5379).

The remote server is running the Ruby on Rails web application.
This version of Rails is reported to be vulnerable to a number of flaws.  It is reported that a remote attacker can perform man-in-the-middle attacks and gain user credentials.  It is also reported that there is a content-parsing flaw in the XML handler that would allow an attacker to either gain unauthorized access to data or cause the application to fail.

ID	Name	Product	Family	Type	Severity
421810	SCA: security update for rails (GHSA-fjfg-q662-gm6j)	Tenable Cloud Security	SCA Checks	Local	medium
421810	SCA: security update for rails (GHSA-fjfg-q662-gm6j)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
29723	Mac OS X Multiple Vulnerabilities (Security Update 2007-009)	Nessus	MacOS X Local Security Checks	Local	critical
28217	GLSA-200711-17 : Ruby on Rails: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	medium
28206	openSUSE 10 Security Update : rubygem-activesupport (rubygem-activesupport-4565)	Nessus	SuSE Local Security Checks	Local	medium
4248	Ruby on Rails < 1.2.5 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers		medium

Detections

Analytics

CVE-2007-5379

medium

Tenable Plugins

medium

medium

critical

medium

medium

medium