Dynamic Render Path RCE

The dynamic render path leads to a potential remote code execution.

An attacker with successful exploitation to the render method may have the ability to execute arbitrary malicious code on the application.

Care should be taken when using user input to determine which view to render. If possible, avoid any user input in the name or path to the view.

Ruby

Vulnerable :

def index
    render params[:id]
end

Non Vulnerable :

def index
    render verify_template(params[:id])
end

private
def verify_template(name)
    # add verification logic
end