Deserialization of Untrusted Data in activesupport - CVE-2020-8165

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data in the "MemCacheStore" and "RedisCacheStore". A remote attacker can pass specially crafted data to the application using the "raw: true" parameter and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

How to mitigate CVE-2020-8165

Links to Public Exploits and PoC-codes

• Exploit #5157 - cve-2020-8165-demo () (February 17, 2021)
• Exploit #5040 - CVE-2020-8165 (PoC for CVE-2020-8165) (January 18, 2021)
• Exploit #5034 - CVE-2020-8165 () (January 18, 2021)
• Exploit #5025 - CVE-2020-8165 (CVE-2020-8165 exploit automation) (January 12, 2021)
• Exploit #4995 - CVE-2020-8165 () (January 5, 2021)
• Exploit #4969 - CVE-2020-8165 () (December 28, 2020)
• Exploit #4852 - CVE-2020-8165--Auto-Shell () (November 17, 2020)
• Exploit #2987 - CVE-2020-8165 () (June 3, 2020)

External References

• https://snyk.io/vuln/SNYK-RUBY-ACTIVESUPPORT-569598
• https://github.com/rails/rails/commit/9b4aef4be3dc58eb08f694387857b52be8050954
• https://groups.google.com/forum/#!topic/rubyonrails-security/bv6fW4S0Y1c

Related Security Bulletins

• Deserialization of Untrusted Data in activesupport toolkit
• Debian update for rails
• OpenSUSE Linux update for rubygem-activesupport-5_1
• OpenSUSE Linux update for rubygem-activesupport-5_1
• openEuler 20.03 LTS SP1 update for rubygem-rails