Description

In development mode, Ruby on Rails application uses an application name as the secret_key_base. It allows an attacker to set a valid signature for a serialized payload to ActiveStorage component. During the deserialization process, ActiveStorage executes arbitrary commands in OS.

Remediation

Upgrade to the latest version of Ruby on Rails

References

Remote Code Execution via Ruby on Rails Active Storage Insecure Deserialization

Related Vulnerabilities

PHP Other Vulnerability (CVE-2005-1042)

MySQL CVE-2020-14845 Vulnerability (CVE-2020-14845)

osCommerce Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-43715)

e107 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2009-4084)

SharePoint Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2014-1754)

Severity

High

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Acumonitor Code Execution Insecure Deserialization Known Vulnerabilities CWE-502 CVE-2019-5420