Fluid Attacks Database

Description

A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalate to a remote code execution exploit.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	rails	>=0 <2:5.2.2.1+dfsg-1	2:5.2.2.1+dfsg-1
rubygems	railties	>=5.2.0 <5.2.2.1	5.2.2.1
rubygems	rails	>=5.2.0 <5.2.2.1 \|\| >=6.0.0.beta1 <6.0.0	5.2.2.1, 6.0.0
debian 13	rails	>=0 <2:5.2.2.1+dfsg-1	2:5.2.2.1+dfsg-1
debian 14	rails	>=0 <2:5.2.2.1+dfsg-1	2:5.2.2.1+dfsg-1

Aliases

1. CVE-2019-54202. NVD-2019-54203. OSV-DEBIAN-2019-54204. OSV-2019-54205. GCVE-2019-54206. SECURITY-TRACKER-CVE-2019-5420

References

1. https://www.exploit-db.com/exploits/467852. https://github.com/knqyf263/CVE-2019-54203. https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/rails_double_tap.rb4. https://github.com/rubysec/ruby-advisory-db/blob/master/gems/railties/CVE-2019-5420.yml5. https://groups.google.com/forum/#!topic/rubyonrails-security/IsQKvDqZdKw6. https://lists.fedoraproject.org/archives/list/[email protected]/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA7. https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released8. http://packetstormsecurity.com/files/152704/Ruby-On-Rails-DoubleTap-Development-Mode-secret_key_base-Remote-Code-Execution.html9. https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/10. https://www.exploit-db.com/exploits/46785/

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.