Remote Code Execution (RCE)

🗓️ 14 Mar 2019 02:16:39Reported by Veracode Vulnerability DatabaseType

railties software vulnerable to remote code execution due to easily guessable secret token

Reporter	Title	Published	Views	Family All 86
0day.today	Ruby On Rails DoubleTap Development Mode secret_key_base Remote Code Execution Exploit	2 May 201900:00	–	zdt
GithubExploit	Exploit for Command Injection in Rubyonrails Rails	6 Sep 202112:28	–	githubexploit
GithubExploit	Exploit for Command Injection in Rubyonrails Rails	20 Jan 202115:06	–	githubexploit
GithubExploit	Exploit for Command Injection in Rubyonrails Rails	6 Sep 202112:28	–	githubexploit
GithubExploit	Exploit for Command Injection in Rubyonrails Rails	21 Mar 201915:42	–	githubexploit
GithubExploit	Exploit for Command Injection in Rubyonrails Rails	11 May 202111:32	–	githubexploit
GithubExploit	Exploit for Path Traversal in Rubyonrails Rails	23 Mar 201902:52	–	githubexploit
GithubExploit	Exploit for Command Injection in Rubyonrails Rails	2 Jul 202215:44	–	githubexploit
ATTACKERKB	Ruby on Rails DoubleTap Development Mode secret_key_base Vulnerability	27 Mar 201900:00	–	attackerkb
BDU FSTEC	The vulnerability of the Ruby on Rails software platform, related to errors in the code for generating pseudo-random numbers, allows attackers to execute arbitrary code.	27 Mar 201900:00	–	bdu_fstec

Vulners

Node

rubyonrails railsMatch2:5.2.2.1+dfsg-1+deb10u1debian

AND

rubyonrails railsMatch2:5.2.2.1+dfsg-1+deb10u2debian

AND

railties railtiesRange6.0.0.beta1–6.0.0.beta2ruby

railties railtiesRange5.2.0.beta1–5.2.2ruby

Source	Link
exploit-db	www.exploit-db.com/exploits/46785/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA/
groups	www.groups.google.com/forum/
packetstormsecurity	www.packetstormsecurity.com/files/152704/Ruby-On-Rails-DoubleTap-Development-Mode-secret_key_base-Remote-Code-Execution.html
groups	www.groups.google.com/forum/
weblog	www.weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/
github	www.github.com/rubysec/ruby-advisory-db/pull/380/files

08 Nov 2023 00:45Current

9.7High risk

Vulners AI Score9.7

CVSS 27.5

CVSS 3.19.8

EPSS0.93513