Rails remote code execution using render :inline

Description

Ruby on Rails web applications that pass unverified user input to the render method in a controller or a view may be vulnerable to a code injection.

Remediation

All users running an affected release should either upgrade or use one of the workarounds immediately. A workaround to this issue is to not pass arbitrary user input to the render method. Instead, verify that data before passing it to the render method. Consult Web references for more information about this issue.

References

Related Vulnerabilities

Severity

Classification

Tags