ID:4852 - Exploit for Deserialization of Untrusted Data in activesupport - CVE-2020-8165

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data in the "MemCacheStore" and "RedisCacheStore". A remote attacker can pass specially crafted data to the application using the "raw: true" parameter and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Remediation