CVE-2016-1000305: 
Ruby vulnerability analysis and mitigation

CVE-2016-1000305 is a directory traversal vulnerability in the guard-livereload Ruby gem that allows remote attackers to read arbitrary files on the server by exploiting improper path validation in the livereload WebSocket server functionality. It affects all versions of guard-livereload before 2.5.2, and was originally discovered and reported on February 4, 2016, with the CVE identifier assigned by the DWF (Distributed Weakness Filing) project. The vulnerability was formally published to the GitHub Advisory Database in July 2026 under GHSA-g65v-27r3-5p6m. It carries a CVSS v4.0 base score of 6.9 (Medium) and a CVSS v3 score of 5.3 (Medium) (GitHub Advisory, Ruby Advisory DB).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal), where the _serve method in lib/guard/livereload/websocket.rb failed to sanitize file paths before serving them over the livereload WebSocket socket (default port 35729). An attacker could send a specially crafted HTTP GET request to the livereload socket with a path such as ./../../etc/passwd, which the server would expand to ../../../etc/passwd and serve the contents of any user-readable file to the requester — no authentication required. The fix (commit 0e98469) changed the behavior so that requests for any file other than ./livereload.js now return a 403 Forbidden response instead of serving the file (GitHub PR #158, GitHub Advisory).

Successful exploitation allows any attacker who can reach the livereload WebSocket port to read arbitrary files accessible to the user running the livereload server process, including sensitive files such as /etc/passwd, application configuration files, private keys, or credentials. There is no impact on integrity or availability, but the confidentiality risk is significant in multi-user server environments or when the WebSocket port is exposed beyond localhost. The vulnerability is particularly dangerous when the livereload socket is bound to a non-local address or when the port is forwarded to untrusted or multi-user remote machines (GitHub Issue #159, GitHub Advisory).

1. Reconnaissance: Identify servers running guard-livereload (versions < 2.5.2) with the livereload WebSocket port (default: 35729) accessible — either directly on the network, via localhost, or through port forwarding.
2. Connect to the livereload socket: Use a tool such as curl, netcat, or a WebSocket client to connect to the target's livereload socket (e.g., http://target:35729/).
3. Craft a path traversal request: Send a specially crafted HTTP GET request with a traversal payload in the path, for example:

   GET ./../../etc/passwd HTTP/1.1
   Host: target:35729

   The leading ./ causes the path to be expanded by the server to ../../../etc/passwd.
4. Receive file contents: The vulnerable server serves the contents of the requested file (e.g., /etc/passwd) directly over the socket, exposing sensitive data to the attacker (GitHub PR #158, GitHub Issue #159).

• Network: Unexpected HTTP GET requests to port 35729 (livereload default) containing path traversal sequences such as ./../../, ../, or encoded variants; connections to the livereload port from untrusted or external IP addresses.
• Logs: Web server or application logs showing GET requests to the livereload socket with unusual path components (e.g., ./../../etc/passwd, ./../../home/user/.ssh/id_rsa).
• Process: The Ruby process running guard-livereload reading files outside the project/web root directory, observable via system call tracing (e.g., strace, auditd file access logs).

Upgrade guard-livereload to version 2.5.2 or later, which restricts file serving over the WebSocket socket to only ./livereload.js and returns a 403 Forbidden for all other file requests. As a workaround, ensure the livereload WebSocket port (default: 35729) is bound only to localhost (127.0.0.1) and is not exposed to untrusted networks or forwarded to remote machines. The Ruby Advisory DB notes that the gem may not have been re-released after the fix, and recommends considering migration to rack-livereload as an alternative (GitHub Advisory, Ruby Advisory DB).