VYPR
← All advisories
Moderate severityNVD Advisory· Published Mar 11, 2014· Updated May 6, 2026

CVE-2013-4413

CVE-2013-4413

Description

Directory traversal vulnerability in controller/concerns/render_redirect.rb in the Wicked gem before 1.0.1 for Ruby allows remote attackers to read arbitrary files via a %2E%2E%2F (encoded dot dot slash) in the step.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
wickedRubyGems
< 1.0.11.0.1

Affected products

20
  • Schneems/Wicked20 versions
    cpe:2.3:a:schneems:wicked:*:*:*:*:*:ruby:*:*+ 19 more
    • cpe:2.3:a:schneems:wicked:*:*:*:*:*:ruby:*:*range: <=1.0.0
    • cpe:2.3:a:schneems:wicked:0.0.1:*:*:*:*:ruby:*:*
    • cpe:2.3:a:schneems:wicked:0.0.2:*:*:*:*:ruby:*:*
    • cpe:2.3:a:schneems:wicked:0.1.0:*:*:*:*:ruby:*:*
    • cpe:2.3:a:schneems:wicked:0.1.1:*:*:*:*:ruby:*:*
    • cpe:2.3:a:schneems:wicked:0.1.2:*:*:*:*:ruby:*:*
    • cpe:2.3:a:schneems:wicked:0.1.3:*:*:*:*:ruby:*:*
    • cpe:2.3:a:schneems:wicked:0.1.4:*:*:*:*:ruby:*:*
    • cpe:2.3:a:schneems:wicked:0.1.5:*:*:*:*:ruby:*:*
    • cpe:2.3:a:schneems:wicked:0.1.6:*:*:*:*:ruby:*:*
    • cpe:2.3:a:schneems:wicked:0.2.0:*:*:*:*:ruby:*:*
    • cpe:2.3:a:schneems:wicked:0.3.0:*:*:*:*:ruby:*:*
    • cpe:2.3:a:schneems:wicked:0.3.1:*:*:*:*:ruby:*:*
    • cpe:2.3:a:schneems:wicked:0.3.2:*:*:*:*:ruby:*:*
    • cpe:2.3:a:schneems:wicked:0.3.3:*:*:*:*:ruby:*:*
    • cpe:2.3:a:schneems:wicked:0.3.4:*:*:*:*:ruby:*:*
    • cpe:2.3:a:schneems:wicked:0.4.0:*:*:*:*:ruby:*:*
    • cpe:2.3:a:schneems:wicked:0.5.0:*:*:*:*:ruby:*:*
    • cpe:2.3:a:schneems:wicked:0.6.0:*:*:*:*:ruby:*:*
    • cpe:2.3:a:schneems:wicked:0.6.1:*:*:*:*:ruby:*:*

Patches

1
fe31bb2533ff

[close #94] Security Update

https://github.com/schneems/wickedschneemsOct 8, 2013via ghsa
commit
5 files changed · +31 −2
  • CHANGELOG.md+4 −0 modified
    @@ -1,3 +1,7 @@
+## 1.0.1 (8/08/2013)
+
+* Fix security issue #94
+
 ## 1.0.0 (8/03/2013)
 
 * Rails 4 compatible tested version released
  • lib/wicked/controller/concerns/render_redirect.rb+1 −1 modified
    @@ -26,7 +26,7 @@ def render_step(the_step, options = {})
     if the_step.nil? || the_step.to_s == Wicked::FINISH_STEP
       redirect_to_finish_wizard options
     else
-      render the_step, options
+      render ERB::Util.url_encode(the_step), options
     end
   end
  • lib/wicked.rb+2 −0 modified
    @@ -1,3 +1,5 @@
+require 'erb'
+
 module Wicked
   FINISH_STEP = "wicked_finish"
   FIRST_STEP  = "wicked_first"
  • test/integration/security_test.rb+23 −0 added
    @@ -0,0 +1,23 @@
+require 'test_helper'
+
+class SecurityTest < ActiveSupport::IntegrationCase
+
+  test 'does not show database.yml' do
+    step = "%2E%2F%2E%2E%2F%2E%2E%2Fconfig%2Fdatabase%2Eyml"
+    assert_raise ActionView::MissingTemplate do
+      visit(bar_path(step))
+    end
+    refute has_content?('sqlite3')
+  end
+
+  # only works on *nix systems
+  test 'does not show arbitrary system file' do
+    root = '%2E%2F%2E' * 100 # root of system
+    step = root + '%2Fusr%2Fshare%2Fdict%2Fwords'
+
+    assert_raise ActionView::MissingTemplate do
+      visit(bar_path(step))
+    end
+    refute has_content?('aardvark')
+  end
+end
  • VERSION+1 −1 modified
    @@ -1 +1 @@
-1.0.0
+1.0.1

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

9

News mentions

0

No linked articles in our index yet.