Immunity Canvas: RAILS_ACTIVESTORAGE_RCE

🗓️ 27 Mar 2019 14:29:00Reported by Immunity CanvasType

canvas🔗 exploitlist.immunityinc.com👁 72 Views

Ruby on Rails Arbitrary Deserialization RCE (CVE-2019-5420) vulnerability in ActionStorage component due to insufficient validation on Marshal.load(). Exploits production Rails applications vulnerable to Arbitrary File Disclosure (CVE-2019-5418) to obtain secret_key. Controller vulnerable to CVE-2019-5418 needed in path textfield. Affects Rails versions: < 5.2.2.1, < 5.1.6.2, < 5.0.7.2, < 4.2.11.1

Reporter	Title	Published	Views	Family All 206
0day.today	Rails 5.2.1 - Arbitrary File Content Disclosure Exploit	24 Mar 201900:00	–	zdt
0day.today	Ruby On Rails DoubleTap Development Mode secret_key_base Remote Code Execution Exploit	2 May 201900:00	–	zdt
FreeBSD	Rails -- Action View vulnerabilities	13 Mar 201900:00	–	freebsd
GithubExploit	Exploit for Path Traversal in Rubyonrails Rails	4 Oct 201919:28	–	githubexploit
GithubExploit	Exploit for Path Traversal in Rubyonrails Rails	19 Mar 201915:38	–	githubexploit
GithubExploit	Exploit for Command Injection in Rubyonrails Rails	6 Sep 202112:28	–	githubexploit
GithubExploit	Exploit for Command Injection in Rubyonrails Rails	20 Jan 202115:06	–	githubexploit
GithubExploit	Exploit for Command Injection in Rubyonrails Rails	6 Sep 202112:28	–	githubexploit
GithubExploit	Exploit for Path Traversal in Rubyonrails Rails	18 Mar 201916:09	–	githubexploit
GithubExploit	Exploit for Command Injection in Rubyonrails Rails	21 Mar 201915:42	–	githubexploit