PT-2019-1632 · Ruby+2 · Ruby On Rails+2
Ooooooo_Q
·
Publicado
2019-03-13
·
Atualizado
2025-09-29
·
CVE-2019-5420
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Ruby on Rails versions prior to 5.2.2.1
Ruby on Rails versions prior to 6.0.0.beta3
Description
A remote code execution issue exists in development mode Rails, allowing an attacker to guess the automatically generated development mode secret token. This token can be used in combination with other Rails internals to escalate to a remote code execution exploit. The vulnerability is related to errors in the pseudorandom number generator code.
Recommendations
For versions prior to 5.2.2.1, upgrade to version 5.2.2.1 or later.
For versions prior to 6.0.0.beta3, upgrade to version 6.0.0.beta3 or later.
As a temporary workaround, specify a secret key in development mode by adding
config.secret key base = SecureRandom.hex(64) to "config/environments/development.rb".Exploit
Correção
RCE
Use of Insufficiently Random Values
Command Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Ruby On Rails
Suse