CVSS: 9.8EPSS: 66%CPEs: 7EXPL: 7CVE-2020-8165 – rubygem-activesupport: potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
https://notcve.org/view.php?id=CVE-2020-8165
A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE. Se presenta una vulnerabilidad de deserialización de datos no confiables en rails versiones anteriores a 5.2.4.3, rails versiones anteriores a 6.0.3.1, que puede permitir a un atacante desarmar los objetos proporcionados por el usuario en MemCacheStore y RedisCacheStore, lo que podría generar un RCE A flaw was found in rubygem-activesupport. An untrusted user input can be written to the cache store using the `raw: true` parameter which can lead to the result being evaluated as a marshaled object instead of plain text. The threat from this vulnerability is to data confidentiality and integrity as well as system availability. • https://github.com/masahiro331/CVE-2020-8165 https://github.com/hybryx/CVE-2020-8165 https://github.com/progfay/CVE-2020-8165 https://github.com/AssassinUKG/CVE-2020-8165 https://github.com/taipansec/CVE-2020-8165 https://github.com/umiterkol/CVE-2020-8165--Auto-Shell http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00031.html http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00034.html https://groups.google.com/g/rubyonrails-security/c/bv6fW4S0Y1c ht • CWE-20: Improper Input Validation CWE-502: Deserialization of Untrusted Data •
CVSS: 7.5EPSS: 0%CPEs: 8EXPL: 1CVE-2020-8164 – rubygem-actionpack: possible strong parameters bypass
https://notcve.org/view.php?id=CVE-2020-8164
A deserialization of untrusted data vulnerability exists in rails < 5.2.4.3, rails < 6.0.3.1 which can allow an attacker to supply information can be inadvertently leaked fromStrong Parameters. Se presenta una vulnerabilidad de deserialización de datos no confiables en rails versiones anteriores a 5.2.4.3, rails versiones anteriores a 6.0.3.1, que pueden permitir a un atacante suministrar información en la que pueden ser filtrados inadvertidamente parámetros fromStrong A flaw was found in rubygem-actionpack. Untrusted hashes of data is possible for values of `each`, `each_value`, and `each_pair` which can lead to cases of user supplied information being leaked from Strong Parameters. Applications that use these hashes may inadvertently use untrusted user input. The highest risk from this vulnerability is to data confidentiality. • http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00089.html http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00093.html http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00107.html https://groups.google.com/g/rubyonrails-security/c/f6ioe4sdpbY https://hackerone.com/reports/292797 https://lists.debian.org/debian-lts-announce/2020/06/msg00022.html https://lists.debian.org/debian-lts-announce/2020/07/msg00013.html https://www.debian.org/security/2020 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-502: Deserialization of Untrusted Data •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 1CVE-2020-8162 – rubygem-activestorage: circumvention of file size limits in ActiveStorage
https://notcve.org/view.php?id=CVE-2020-8162
A client side enforcement of server side security vulnerability exists in rails < 5.2.4.2 and rails < 6.0.3.1 ActiveStorage's S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user bypassing upload limits. Se presenta una aplicación del lado del cliente de una vulnerabilidad de seguridad del lado del servidor en rails versiones anteriores a 5.2.4.2 y rails versiones anteriores a 6.0.3.1 El adaptador S3 de ActiveStorage que permite a un usuario final modificar el Content-Length de una carga directa de archivos sin pasar por los límites de carga A flaw was found in rubygem-activestorage. The ActiveStorage's S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user. The highest threat from this vulnerability is to data integrity. • https://groups.google.com/g/rubyonrails-security/c/PjU3946mreQ https://hackerone.com/reports/789579 https://www.debian.org/security/2020/dsa-4766 https://access.redhat.com/security/cve/CVE-2020-8162 https://bugzilla.redhat.com/show_bug.cgi?id=1843005 • CWE-20: Improper Input Validation CWE-434: Unrestricted Upload of File with Dangerous Type CWE-602: Client-Side Enforcement of Server-Side Security •
CVSS: 9.8EPSS: 96%CPEs: 5EXPL: 12CVE-2019-5420 – Ruby On Rails - DoubleTap Development Mode secret_key_base Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-5420
A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalate to a remote code execution exploit. Una vulnerabilidad de ejecución remota de código en el modo de desarrollo de Rails, en versiones anteriores a la 5.2.2.1 y la 6.0.0.beta3, podría permitir que un atacante adivine el token secreto del modo de desarrollo generado automáticamente. Este token secreto puede emplearse en combinación con otros internals de Rails para escalar a un exploit de ejecución remota de código. • https://www.exploit-db.com/exploits/46785 https://github.com/knqyf263/CVE-2019-5420 https://github.com/j4k0m/CVE-2019-5420 https://github.com/laffray/ruby-RCE-CVE-2019-5420- https://github.com/scumdestroy/CVE-2019-5420.rb https://github.com/trickstersec/CVE-2019-5420 https://github.com/Eremiel/CVE-2019-5420 https://github.com/PenTestical/CVE-2019-5420 https://github.com/AnasTaoutaou/CVE-2019-5420 https://github.com/CyberSecurityUP/CVE-2019-5420-POC https://githu • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-330: Use of Insufficiently Random Values •
CVSS: 7.8EPSS: 0%CPEs: 11EXPL: 1CVE-2019-5419 – rubygem-actionpack: denial of service vulnerability in Action View
https://notcve.org/view.php?id=CVE-2019-5419
There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted accept headers can cause action view to consume 100% cpu and make the server unresponsive. Hay una posible vulnerabilidad de denegación de servicio (DoS) en la vista de acción en Rails, en versiones anteriores a las 5.2.2.1, 5.1.6.2, 5.0.7.2 y 4.2.11.1 donde las cabeceras de aceptación especialmente manipuladas pueden provocar que dicha vista consuma el 100 % de la CPU y haga que el servidor deje de responder. • http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00011.html http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00025.html http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00001.html http://www.openwall.com/lists/oss-security/2019/03/22/1 https://access.redhat.com/errata/RHSA-2019:0796 https://access.redhat.com/errata/RHSA-2019:1147 https://access.redhat.com/errata/RHSA-2019:1149 https://access.redhat.com/errata/RHSA-2019:1289 https:/ • CWE-20: Improper Input Validation CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •