Multiple vulnerabilities in actionpack gem for Ruby



Published: 2020-05-26
Risk Medium
Patch available YES
Number of vulnerabilities 2
CVE-ID CVE-2020-8164
CVE-2020-8166
CWE-ID CWE-200
CWE-352
Exploitation vector Network
Public exploit Public exploit code for vulnerability #2 is available.
Vulnerable software
Subscribe
actionpack
Web applications / Modules and components for CMS

Vendor Ruby

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Information disclosure

EUVDB-ID: #VU28243

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2020-8164

CWE-ID: CWE-200 - Information Exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in the return value of "each", or "each_value", or "each_pair" will return the underlying "untrusted" hash of data that was read from the parameters. A remote attacker can gain unauthorized access to sensitive information on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

actionpack: 6.0.0 - 6.0.3 rc1, 5.2.0 - 5.2.4.2, 5.1.0 - 5.1.7 rc1, 5.0.0 - 5.0.7.2


CPE2.3 External links

http://snyk.io/vuln/SNYK-RUBY-ACTIONPACK-569600
http://github.com/rails/rails/commit/b3230c500d780b5a5d500cc57496074e1d3d8ea9
http://groups.google.com/forum/#!topic/rubyonrails-security/f6ioe4sdpbY

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

2) Cross-site request forgery

EUVDB-ID: #VU28244

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2020-8166

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin in the "authenticity_token" meta tag. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

actionpack: 6.0.0 - 6.0.3 rc1, 5.2.0 - 5.2.4.2, 5.1.0 - 5.1.7 rc1, 5.0.0 - 5.0.7.2


CPE2.3 External links

http://snyk.io/vuln/SNYK-RUBY-ACTIONPACK-569599
http://github.com/rails/rails/commit/d124f19287f4892c72ca54da728a781591c6fca1
http://groups.google.com/forum/#!topic/rubyonrails-security/NOjKiGeXUgw

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###