Code injection in Ruby - CVE-2019-16255

Vulnerability identifier: #VU23009

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-16255

CWE-ID: CWE-94

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in lib/shell.rb in Ruby when processing Shell#[] and its alias Shell#test. A remote attacker can send a specially crafted request and execute arbitrary Ruby code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Ruby
Gentoo Linux
Amazon Linux AMI
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Opensuse
Red Hat Software Collections
ruby (Alpine package)
ruby2.3 (Debian package)
ruby2.5 (Debian package)
ruby2.5 (Ubuntu package)
rh-ruby25-ruby (Red Hat package)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
rh-ruby26-ruby (Red Hat package)
EMC Integrated Data Protection Appliance
IBM Cloud Foundry Migration Runtime
Dell EMC Data Protection Search

Install updates from vendor's website.

Ruby - addressed in versions 2.4.8, 2.5.7, 2.6.5
ruby (Alpine package) - update to 2.5.7-r0
EMC Integrated Data Protection Appliance - update to 2.7.1
ruby2.3 (Debian package) - update to 2.3.3-1+deb9u7
ruby2.5 (Debian package) - update to 2.5.5-3+deb10u1
ruby2.5 (Ubuntu package) - addressed in versions 2.5.1-1ubuntu1.6, 2.5.5-1ubuntu1.1, 2.5.5-4ubuntu2.1
rh-ruby25-ruby (Red Hat package) - update to 2.5.9-9.el7
IBM Cloud Foundry Migration Runtime - update to 4.1.2
Dell EMC Data Protection Search - update to 19.6.0
rh-ruby26-ruby (Red Hat package) - update to 2.6.7-119.el7

• https://www.ruby-lang.org/en/news/2019/10/01/code-injection-shell-test-cve-2019-16255/
• https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-4-8-released/
• https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-5-7-released/
• https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-6-5-released/
• https://hackerone.com/reports/327512

• Multiple vulnerabilities in Ruby
• Ubuntu update for Ruby
• Debian update for ruby2.3
• Debian update for ruby2.5
• Gentoo update for Ruby
• OpenSUSE update for ruby
• Code injection in ruby (Alpine package)
• Amazon Linux AMI update for ruby24
• Red Hat Software Collections update for rh-ruby25-ruby
• Red Hat Software Collections update for rh-ruby26-ruby
• Red Hat Enterprise Linux 8 update for the ruby:2.5 module
• Red Hat Enterprise Linux 8 update for the ruby:2.6 module
• Red Hat Enterprise Linux 8.1 update for the ruby:2.6 module
• Red Hat Enterprise Linux 8.2 update for the ruby:2.6 module
• Multiple vulnerabilities in Dell EMC Integrated Data Protection Appliance
• Multiple vulnerabilities in Dell EMC Data Protection Search
• Multiple vulnerabilities in IBM Cloud Foundry Migration Runtime