Improper Authorization in actionpack - CVE-2020-8185

Vulnerability identifier: #VU29212

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-8185

CWE-ID: CWE-285

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass authorization process.

The vulnerability exists due to improper authorization. A remote attacker can execute any migrations that are pending for a Rails app running in production mode.

actionpack
Fedora
rubygem-image_processing
rubygem-actioncable
rubygem-railties
rubygem-rails
rubygem-activesupport
rubygem-activestorage
rubygem-activerecord
rubygem-activemodel
rubygem-activejob
rubygem-actionview
rubygem-actiontext
rubygem-actionmailer
rubygem-actionmailbox
rubygem-actionpack

Install updates from vendor's website.

actionpack - update to 6.0.3.2
rubygem-image_processing - update to 1.11.0-1.fc33
rubygem-actioncable - addressed in versions 6.0.3.3-1.fc33, 6.0.3.3-1.fc34
rubygem-railties - addressed in versions 6.0.3.3-1.fc33, 6.0.3.3-1.fc34
rubygem-rails - addressed in versions 6.0.3.3-1.fc33, 6.0.3.3-1.fc34
rubygem-activesupport - addressed in versions 6.0.3.3-1.fc33, 6.0.3.3-1.fc34
rubygem-activestorage - addressed in versions 6.0.3.3-1.fc33, 6.0.3.3-1.fc34
rubygem-activerecord - addressed in versions 6.0.3.3-1.fc33, 6.0.3.3-1.fc34
rubygem-activemodel - addressed in versions 6.0.3.3-1.fc33, 6.0.3.3-1.fc34
rubygem-activejob - addressed in versions 6.0.3.3-1.fc33, 6.0.3.3-1.fc34
rubygem-actionview - addressed in versions 6.0.3.3-1.fc33, 6.0.3.3-1.fc34
rubygem-actiontext - addressed in versions 6.0.3.3-1.fc33, 6.0.3.3-1.fc34
rubygem-actionmailer - addressed in versions 6.0.3.3-1.fc33, 6.0.3.3-1.fc34
rubygem-actionmailbox - addressed in versions 6.0.3.3-1.fc33, 6.0.3.3-1.fc34
rubygem-actionpack - addressed in versions 6.0.3.3-2.fc33, 6.0.3.3-2.fc34

• https://snyk.io/vuln/SNYK-RUBY-ACTIONPACK-572498
• https://github.com/rails/rails/commit/661da266b94909574426fd1121ef13b800e01b9a
• https://groups.google.com/g/rubyonrails-security/c/pAe9EV8gbM0

• Improper Authorization in actionpack gem for Ruby
• Fedora 34 update for rubygem-actioncable, rubygem-actionmailbox, rubygem-actionmailer, rubygem-actionpack, rubygem-actiontext, rubygem-actionview, rubygem-activejob, rubygem-activemodel, rubygem-activerecord, rubygem-activestorage, rubygem-activesupport,
• Fedora 33 update for rubygem-actioncable, rubygem-actionmailbox, rubygem-actionmailer, rubygem-actionpack, rubygem-actiontext, rubygem-actionview, rubygem-activejob, rubygem-activemodel, rubygem-activerecord, rubygem-activestorage, rubygem-activesupport,