CVE-2019-5420: Command Injection
First published: Wed Mar 27 2019(Updated: )
A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalate to a remote code execution exploit.
Credit: support@hackerone.com support@hackerone.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Rubyonrails Rails | <5.2.2.1 | |
| Rubyonrails Rails | =6.0.0-beta1 | |
| Rubyonrails Rails | =6.0.0-beta2 | |
| Debian Debian Linux | =8.0 | |
| Fedoraproject Fedora | =30 | |
| <5.2.2.1 | ||
| =6.0.0-beta1 | ||
| =6.0.0-beta2 | ||
| =8.0 | ||
| =30 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/152704/Ruby-On-Rails-DoubleTap-Development-Mode-secret_key_base-Remote-Code-Execution.html
- https://groups.google.com/forum/#!topic/rubyonrails-security/IsQKvDqZdKw
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA/
- https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/
- https://www.exploit-db.com/exploits/46785/
- https://groups.google.com/forum/#%21topic/rubyonrails-security/IsQKvDqZdKw
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA/
Frequently Asked Questions
What is CVE-2019-5420?
CVE-2019-5420 is a remote code execution vulnerability in development mode Rails <5.2.2.1 <6.0.0.beta3.
What is the severity of CVE-2019-5420?
The severity of CVE-2019-5420 is critical with a CVSS score of 9.8.
How does CVE-2019-5420 work?
CVE-2019-5420 allows an attacker to guess the automatically generated development mode secret token and use it to escalate to a remote code execution exploit.
Which versions of Ruby on Rails are affected by CVE-2019-5420?
Ruby on Rails versions prior to 5.2.2.1 and 6.0.0.beta3 are affected by CVE-2019-5420.
How can I fix CVE-2019-5420?
To fix CVE-2019-5420, update Ruby on Rails to version 5.2.2.1 or later, or 6.0.0.beta3 or later.
- collector/nvd-index
- agent/type
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/references
- agent/severity
- agent/description
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/author
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/event
- vendor/rubyonrails
- canonical/rubyonrails rails
- version/rubyonrails rails/6.0.0-beta1
- version/rubyonrails rails/6.0.0-beta2
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/8.0
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/30