Path Traversal in YARD Documentation Tool

Executive Summary

This vulnerability exists in YARD, a documentation generation tool for Ruby. Before version 0.9.44, YARD's static cache lookup reads the requested path before the router cleans it up. If the server is set with a document root, an attacker can craft a path with directory traversal sequences like '/../yard-cache-secret.html' which allows access to .html files outside the intended directory. This means the server can return contents of files that should not be accessible.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an attacker to read arbitrary .html files outside the intended document root, potentially disclosing sensitive information contained in those files.

Such unauthorized information disclosure could lead to non-compliance with data protection regulations like GDPR or HIPAA if the exposed files contain personal or sensitive data protected under these standards.

Therefore, organizations using vulnerable versions of YARD may face increased risk of violating confidentiality requirements mandated by these regulations.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to information disclosure by allowing an attacker to read arbitrary .html files outside the configured document root. This could expose sensitive HTML content that was not meant to be publicly accessible. The severity is rated as Moderate with a CVSS score of 5.3.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to access files outside the intended document root using crafted traversal paths in requests, such as '/../yard-cache-secret.html'. If the server returns the contents of such files, it indicates the presence of the vulnerability.

You can test this by sending HTTP requests to the YARD documentation server with traversal sequences in the URL path and observing if files outside the document root are accessible.

• Use curl to send a request with a traversal path: curl -v http://<server_address>/../yard-cache-secret.html
• Monitor server logs for requests containing '/../' or other directory traversal patterns.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade YARD to version 0.9.44 or later, where the vulnerability has been patched.

The patch sanitizes request paths by rejecting those containing '..' components and normalizing paths to prevent directory traversal.

Until the upgrade can be applied, consider restricting access to the YARD documentation server to trusted networks or users to reduce exposure.

Useful 0 Not Useful 0