HTTP: Ruby On Rails ActiveStorage Insecure Deserialization

This signature detects attempts to exploit a known vulnerability against Ruby on Rails. This vulnerability is due to deserializing a Ruby object within an HTTP URL using Marshal.load() without sufficient validation. A remote unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests embedding malicious serialized objects to a vulnerable application. Successful exploitation would result in arbitrary code execution under the security context on the affected Ruby on Rails application.

Extended Description

A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalate to a remote code execution exploit.

Affected Products

Rubyonrails rails

References

CVE: CVE-2019-5420

Short Name

HTTP:RUBYONRAILS-RCE

Severity

Major

Recommended

True

Recommended Action

Drop

HTTP: Ruby On Rails ActiveStorage Insecure Deserialization

Extended Description

Affected Products

References

Found a potential security threat?