WEBrick v.1.3 directory traversal

Description
  • Directory Traversal is a vulnerability which allows attackers to access restricted directories and execute commands outside of the web server's root directory.

    The following programs are vulnerable.
    Programs that publish files using WEBrick::HTTPServer.new with the :DocumentRoot option
    Programs that publish files using WEBrick::HTTPServlet::FileHandler

    Affected systems are:
    1. Systems that accept backslash (\) as a path separator, such as Windows.
    2. Systems that use case insensitive file-systems such as NTFS on Windows, HFS on Mac OS X.
Remediation
  • Your script should filter metacharacters from user input.
References