Description

In development mode, Ruby on Rails application uses an application name as the secret_key_base. It allows an attacker to set a valid signature for a serialized payload to ActiveStorage component. During the deserialization process, ActiveStorage executes arbitrary commands in OS.

Remediation

Upgrade to the latest version of Ruby on Rails

References

Remote Code Execution via Ruby on Rails Active Storage Insecure Deserialization

Related Vulnerabilities

e107 Other Vulnerability (CVE-2005-3594)

ownCloud Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2014-2057)

Apache Traffic Server Improper Input Validation Vulnerability (CVE-2021-32567)

PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2018-10545)

MySQL Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-8286)

Severity

High

Classification

CVE-2019-5420 CWE-502 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Acumonitor Code Execution Insecure Deserialization Known Vulnerabilities