Description

In development mode, Ruby on Rails application uses an application name as the secret_key_base. It allows an attacker to set a valid signature for a serialized payload to ActiveStorage component. During the deserialization process, ActiveStorage executes arbitrary commands in OS.

Remediation

Upgrade to the latest version of Ruby on Rails

References

Remote Code Execution via Ruby on Rails Active Storage Insecure Deserialization

Related Vulnerabilities

WordPress Plugin eShop Code Injection (6.3.11)

vBulletin 5 CONNECT remote code execution

WordPress OptimizePress unrestricted file upload

Sitecore XP Deserialization RCE (CVE-2021-42237)

PHP version older than 5.2.6

Severity

High

Classification

CWE-502 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Acumonitor Code Execution Insecure Deserialization