Cloudanix VulnDB

CVE-2017-17042

High · 7.5

CVSS

7.5

EPSS

2.9%

Published

Nov 28, 2017

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the YARD tool's server allowed outsiders to read any file on the computer by using special paths in requests.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Trivial
Impact
Data Exposure
Component
Application
Class
Path Traversal
Remediation
Upgrade
Effort
Low
Patch risk
Low

What it actually does

The vulnerability permits unauthenticated attackers to traverse directories and read arbitrary files on the server by supplying paths starting with '../' to the YARD documentation server.

Why it matters to the business

Attackers can access sensitive configuration files, source code, or other data stored on the system hosting the YARD server, potentially leading to information disclosure that aids further attacks; downstream packages like rootlesskit increase exposure across container tooling ecosystems.

How an attack unfolds

An attacker sends crafted HTTP requests to the YARD server containing relative path sequences like '../' to access files outside the intended directory.

How to fix it

Upgrade YARD to 0.9.11 or later; for affected packages apply rootlesskit 2.1.0-r1 (Chainguard/Wolfi) and lsegal/yard commit 7748eda4b96817b0b9ebd7efffbd32d510829393.

How to confirm the fix worked

Confirm YARD version is 0.9.11 or newer; test that HTTP requests containing '../' sequences return errors instead of file contents.

Typical attack path

  1. Identify an exposed YARD server instance via network scanning or public documentation sites
  2. Craft HTTP GET requests containing initial '../' sequences targeting file-serving endpoints
  3. Read arbitrary sensitive files such as configuration or credential data
  4. Leverage disclosed information to escalate access or pivot within the environment

How to detect it

Inspect web server logs for requests containing '../' sequences targeting YARD endpoints and monitor for unusual file access patterns or responses containing system file contents.

  • ../ sequences in HTTP request paths to YARD server endpoints
  • HTTP responses containing contents of files such as /etc/passwd or application configuration

What your security team should do

  • Immediately upgrade all YARD and dependent rootlesskit installations to the listed fixed versions
  • Scan environments for any exposed YARD servers and restrict network access
  • Review web access logs for historical '../' path traversal attempts

The record

lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.

Affected packages

Ecosystem Package Introduced Fixed
RubyGems yard 0 0.9.11
Debian:11 yard 0 0.9.12-1
Debian:12 yard 0 0.9.12-1
Debian:13 yard 0 0.9.12-1
SUSE:Linux Enterprise Software Development Kit 12 SP3 rubygem-yard 0 0.8.7.3-7.3.1
Ubuntu:18.04:LTS yard 0 0.9.12-2
Ubuntu:20.04:LTS yard 0 0.9.24-1+deb11u1build0.20.04.1
Ubuntu:22.04:LTS yard 0 0.9.26-1ubuntu0.1
Ubuntu:23.10 yard 0 0.9.28-2ubuntu0.1
Ubuntu:Pro:16.04:LTS yard 0 0.8.7.6+git20160220-3ubuntu0.1~esm1
Ubuntu:Pro:18.04:LTS yard 0 0.9.12-2ubuntu0.1~esm1

Related vulnerabilities