CVE-2022-32224: SQL Injection
A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2.8.1 which could allow an attacker, that can manipulate data in the database (via means like SQL injection), the ability to escalate to an RCE.
Other sources
There is a possible escalation to RCE when using YAML serialized columns in Active Record. When serialized columns that use YAML (the default) are deserialized, Rails uses YAML.unsafeload to convert the YAML data in to Ruby objects. If an attacker can manipulate data in the database (via means like SQL injection), then it may be possible for the attacker to escalate to an RCE.
— Red Hat
When serialized columns that use YAML (the default) are deserialized, Rails uses YAML.unsafeload to convert the YAML data in to Ruby objects. If an attacker can manipulate data in the database (via means like SQL injection), then it may be possible for the attacker to escalate to an RCE.
There are no feasible workarounds for this issue, but other coders (such as JSON) are not impacted.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rubygem-activerecordto a version that resolves this vulnerability.Fixed in 7.0.3.1 - Upgrade
Upgrade
redhat/rubygem-activerecordto a version that resolves this vulnerability.Fixed in 6.1.6.1 - Upgrade
Upgrade
redhat/rubygem-activerecordto a version that resolves this vulnerability.Fixed in 6.0.5.1 - Upgrade
Upgrade
redhat/rubygem-activerecordto a version that resolves this vulnerability.Fixed in 5.2.8.1 - Upgrade
Upgrade
debian/railsto a version that resolves this vulnerability.Fixed in 2:6.1.7.10+dfsg-1~deb12u2Fixed in 2:6.1.7.10+dfsg-1~deb12u3Fixed in 2:7.2.2.2+dfsg-2~deb13u1Fixed in 2:7.2.2.2+dfsg-2~deb13u2Fixed in 2:7.2.4+dfsg-1Fixed in 2:7.2.4+dfsg-2 - Upgrade
Upgrade
rubygems/activerecordto a version that resolves this vulnerability.Fixed in 5.2.8.1 - Upgrade
Upgrade
rubygems/activerecordto a version that resolves this vulnerability.Fixed in 6.0.5.1 - Upgrade
Upgrade
rubygems/activerecordto a version that resolves this vulnerability.Fixed in 6.1.6.1 - Upgrade
Upgrade
rubygems/activerecordto a version that resolves this vulnerability.Fixed in 7.0.3.1 - Upgrade
Upgrade
debian/railsto a version that resolves this vulnerability.Fixed in 2:6.1.6.1+dfsg-1 - Upgrade
Upgrade
Active Recordto a version that resolves this vulnerability.Fixed in 7.0.3.1 - Upgrade
Upgrade
Active Recordto a version that resolves this vulnerability.Fixed in 6.1.6.1 - Upgrade
Upgrade
Active Recordto a version that resolves this vulnerability.Fixed in 6.0.5.1 - Upgrade
Upgrade
Active Recordto a version that resolves this vulnerability.Fixed in 5.2.8.1
Event History
Frequently Asked Questions
What is CVE-2022-32224?
CVE-2022-32224 is a vulnerability that allows for a possible escalation to RCE (Remote Code Execution) when using YAML serialized columns in Active Record in Ruby on Rails.
How does the vulnerability work?
When serialized columns that use YAML are deserialized, Rails uses YAML.unsafe_load to convert the YAML data into Ruby objects. An attacker who can manipulate data in the database could potentially exploit this and escalate to an RCE.
What is the severity of CVE-2022-32224?
CVE-2022-32224 has a severity rating of critical with a severity value of 9.
Which versions of Rubygem ActiveRecord are affected by CVE-2022-32224?
Versions up to and excluding 7.0.3.1, 6.1.6.1, 6.0.5.1, and 5.2.8.1 are affected by CVE-2022-32224.
How do I fix CVE-2022-32224?
To fix CVE-2022-32224, it is recommended to update to version 7.0.3.1, 6.1.6.1, 6.0.5.1, or 5.2.8.1 of Rubygem ActiveRecord, depending on the version you are currently using.