# Directory traversal attack in view resolver

Wildcard route segments let ActionView::FileSystemResolver render files outside view paths via ../ or backslash-escaped traversal, leaking files like Gemfile.

- Payout: hidden
- Severity: medium
- Program: Ruby on Rails
- Found by: lautis
- Disclosed: 2015-07-09
- CVE: CVE-2014-0130
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/3370
- Library page: https://bugbountylibrary.com/r/h1%3A3370
- Tags: area:web domain:web impact:data-leak kind:bounty platform:hackerone sev:medium tech:ruby technique:source-review vuln:info-disclosure vuln:path-traversal

**Target:** ActionView::FileSystemResolver / wildcard route rendering
**Root cause:** Wildcard route segments are passed to Dir.glob in the view resolver without sanitizing traversal sequences; backslashes bypass Rack::Protection::PathTraversal because glob escapes them unless FNM_NOESCAPE is set.
**Steps:**
1. Define route `get '/help/(*action)', controller: 'help'` with an empty HelpController.
2. Request `GET /help/../../../Gemfile` to render a file outside app/views/help.
3. Bypass Rack::Protection::PathTraversal with `GET /help/%5c../%5c../%5c../Gemfile` since resolver treats `\../` as `../`.
**How found:** Noticed wildcard segments render views even without matching action methods, then hypothesized traversal outside view paths and tested ../ and backslash variants against the resolver and middleware.
**Exploitation:** Attacker sends crafted wildcard-segment requests to render arbitrary files reachable by the resolver, disclosing contents such as Gemfile; backslash encoding evades the PathTraversal middleware.
**Insight:** When a framework resolves templates via glob, test backslash-escaped traversal (`%5c../`) to bypass path-traversal middleware that only matches forward slashes.