Bug Bounty Hunting Essentials

Rails dynamic render

On February 12, 2016, a security researcher named John Poulin published a vulnerability affecting all Ruby on Rails (RoR) versions until that moment.

RoR is a web framework based on Ruby. RoR, to generate views for the user, uses something called action view; this component is responsible for rendering all of the information entered by the user and creating the views for the user to be displayed in the browser.

John Poulin discovered that action view did not validate the input entered to create the view, with a code like this:

    def index
      render params[:id]
    end

This function took the app/views/user/#{params[template]} file to render it. As value for parameter is a file with the .html, .htm or .erb extension, which will ...