Ruby on Rails template renderer Accept Header File Disclosure

The strikes replicates an attack on Ruby on Rails which leads to arbitrary file disclosure. The vulnerability resides in the lack of validation of the Accept header which is further parsed within the template renderer.rb file in order to return the template file to be rendered. By exploiting this, a remote unauthenticated attacker may read arbitrary files on the host system.