Description

In development mode, Ruby on Rails application uses an application name as the secret_key_base. It allows an attacker to set a valid signature for a serialized payload to ActiveStorage component. During the deserialization process, ActiveStorage executes arbitrary commands in OS.

Remediation

Upgrade to the latest version of Ruby on Rails

References

Remote Code Execution via Ruby on Rails Active Storage Insecure Deserialization

Related Vulnerabilities

WebLogic Deserialization of Untrusted Data Vulnerability (CVE-2020-9546)

PrestaShop Improper Input Validation Vulnerability (CVE-2023-39530)

Internet Information Services CVE-2001-0146 Vulnerability (CVE-2001-0146)

Liferay Portal Cleartext Storage of Sensitive Information Vulnerability (CVE-2021-33325)

WordPress Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2014-5240)

Severity

High

Classification

CVE-2019-5420 CWE-502 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Acumonitor Code Execution Insecure Deserialization Known Vulnerabilities