CVSS: 9.8EPSS: 96%CPEs: 5EXPL: 12CVE-2019-5420 – Ruby On Rails - DoubleTap Development Mode secret_key_base Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-5420
A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalate to a remote code execution exploit. Una vulnerabilidad de ejecución remota de código en el modo de desarrollo de Rails, en versiones anteriores a la 5.2.2.1 y la 6.0.0.beta3, podría permitir que un atacante adivine el token secreto del modo de desarrollo generado automáticamente. Este token secreto puede emplearse en combinación con otros internals de Rails para escalar a un exploit de ejecución remota de código. • https://www.exploit-db.com/exploits/46785 https://github.com/knqyf263/CVE-2019-5420 https://github.com/j4k0m/CVE-2019-5420 https://github.com/laffray/ruby-RCE-CVE-2019-5420- https://github.com/scumdestroy/CVE-2019-5420.rb https://github.com/trickstersec/CVE-2019-5420 https://github.com/Eremiel/CVE-2019-5420 https://github.com/PenTestical/CVE-2019-5420 https://github.com/AnasTaoutaou/CVE-2019-5420 https://github.com/CyberSecurityUP/CVE-2019-5420-POC https://githu • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-330: Use of Insufficiently Random Values •
CVSS: 7.8EPSS: 0%CPEs: 11EXPL: 1CVE-2019-5419 – rubygem-actionpack: denial of service vulnerability in Action View
https://notcve.org/view.php?id=CVE-2019-5419
There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted accept headers can cause action view to consume 100% cpu and make the server unresponsive. Hay una posible vulnerabilidad de denegación de servicio (DoS) en la vista de acción en Rails, en versiones anteriores a las 5.2.2.1, 5.1.6.2, 5.0.7.2 y 4.2.11.1 donde las cabeceras de aceptación especialmente manipuladas pueden provocar que dicha vista consuma el 100 % de la CPU y haga que el servidor deje de responder. • http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00011.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00025.html http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00001.html http://www.openwall.com/lists/oss-security/2019/03/22/1 https://access.redhat.com/errata/RHSA-2019:0796 https://access.redhat.com/errata/RHSA-2019:1147 https://access.redhat.com/errata/RHSA-2019:1149 https://access.redhat.com/errata/RHSA-2019:1289 https:/ • CWE-20: Improper Input Validation CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 8.1EPSS: 97%CPEs: 10EXPL: 9CVE-2019-5418 – Rails 5.2.1 - Arbitrary File Content Disclosure
https://notcve.org/view.php?id=CVE-2019-5418
There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed. Existe una vulnerabilidad de Divulgación del contenido del archivo en la Vista de acción versión anterior a .2.2.1, versión anterior a 1.6.2, versión anterior a 5.0.7.2, versión anterior a 4.2.11.1 y v3, donde los encabezados de aceptación especialmente diseñados pueden exponer el contenido de archivos arbitrarios en el sistema de archivos del sistema de destino. . A content disclosure flaw was found in rubygem-actionview. Specially crafted accept headers, in combination with calls to 'render file:', can cause arbitrary files on the target server to be rendered, disclosing the file contents. Code execution cannot be ruled out if the attacker is able to gain access to the proper files. • https://www.exploit-db.com/exploits/46585 https://github.com/mpgn/CVE-2019-5418 https://github.com/brompwnie/CVE-2019-5418-Scanner https://github.com/omarkurt/CVE-2019-5418 https://github.com/takeokunn/CVE-2019-5418 https://github.com/random-robbie/CVE-2019-5418 https://github.com/kailing0220/CVE-2019-5418 https://github.com/ztgrace/CVE-2019-5418-Rails3 http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00011.html http://packetstormsecurity.com/files/152178/Rai • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 1CVE-2018-16476 – activejob: Information Exposure through deserialization using GlobalId
https://notcve.org/view.php?id=CVE-2018-16476
A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have. This vulnerability has been fixed in versions 4.2.11, 5.0.7.1, 5.1.6.1, and 5.2.1.1. Una vulnerabilidad del Control de acceso roto en las versiones de Trabajo activo> = versión 4.2.0 permite a un atacante crear una entrada de usuario que puede hacer que el Trabajo activo lo deserialice con GlobalId y les dé acceso a la información que no deberían tener. Esta vulnerabilidad se ha corregido en las versiones 4.2.11, 5.0.7.1, 5.1.6.1 y 5.2.1.1. A deserialization flaw, leading to an information exposure flaw, was found in the activejob component used by Red Hat CloudForms and Red Hat Satellite. • https://access.redhat.com/errata/RHSA-2019:0600 https://groups.google.com/d/msg/rubyonrails-security/FL4dSdzr2zw/zjKVhF4qBAAJ https://weblog.rubyonrails.org/2018/11/27/Rails-4-2-5-0-5-1-5-2-have-been-released https://access.redhat.com/security/cve/CVE-2018-16476 https://bugzilla.redhat.com/show_bug.cgi?id=1659223 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-284: Improper Access Control CWE-502: Deserialization of Untrusted Data •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2018-16477
https://notcve.org/view.php?id=CVE-2018-16477
A bypass vulnerability in Active Storage >= 5.2.0 for Google Cloud Storage and Disk services allow an attacker to modify the `content-disposition` and `content-type` parameters which can be used in with HTML files and have them executed inline. Additionally, if combined with other techniques such as cookie bombing and specially crafted AppCache manifests, an attacker can gain access to private signed URLs within a specific storage path. This vulnerability has been fixed in version 5.2.1.1. Una vulnerabilidad de omisión en Active Storage >= versión 5.2.0 de Google Cloud Storage and Disk services, permite a un atacante modificar los parámetros `content-disposition` y` content-type` que se pueden usar con archivos HTML y ejecutarlos en línea. Además, si se combina con otras técnicas como el bombardeo de cookies y los manifiestos de AppCache especialmente creados, un atacante puede obtener acceso a URL firmadas privadas dentro de una ruta de almacenamiento específica. • https://groups.google.com/d/msg/rubyonrails-security/3KQRnXDIuLg/mByx5KkqBAAJ https://weblog.rubyonrails.org/2018/11/27/Rails-4-2-5-0-5-1-5-2-have-been-released • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •