OS Command Injection in Rack - CVE-2022-30123

Vulnerability identifier: #VU64863

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-30123

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation when handling input passed via Rack's Lint middleware and CommonLogger middleware. A remote unauthenticated attacker can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Rack
Gentoo Linux
Oracle Linux
Debian Linux
SUSE Manager Server
SUSE Manager Proxy
SUSE Manager Retail Branch Server
Anolis OS
Red Hat Enterprise Linux Resilient Storage for x86_64
Fedora
SUSE OpenStack Cloud Crowbar
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise High Availability
SUSE Linux Enterprise Server
openSUSE Leap
Ubuntu
openEuler
OpenShift Logging
IBM Watson Discovery for IBM Cloud Pak for Data
Contrail Cloud
ruby-rack (Ubuntu package)
rubygem-thread_safe (Red Hat package)
pcs-snmp
pcs
pcs (Red Hat package)
rubygem-mustermann (Red Hat package)
rubygem-concurrent-ruby (Red Hat package)
rubygem-tzinfo (Red Hat package)
ruby2.1-rubygem-rack
rubygem-i18n (Red Hat package)
python-django (Red Hat package)
ruby2.5-rubygem-rack-doc
ruby2.5-rubygem-rack
ruby2.5-rubygem-rack-testsuite
rubygem-tilt (Red Hat package)
ruby-rack (Debian package)
rubygem-rack-protection (Red Hat package)
rubygem-sinatra (Red Hat package)
dev-ruby/rack
rubygem-rack
rubygem-rack-help
rubygem-rack (Red Hat package)
rubygem-nio4r (Red Hat package)
ruby (Red Hat package)
rubygem-bcrypt (Red Hat package)
rubygem-puma (Red Hat package)
rubygem-activesupport (Red Hat package)
rubygem-activemodel (Red Hat package)
grafana (Red Hat package)
IBM Cloud Pak for Multicloud Management

Install updates from vendor's website.

Rack - addressed in versions 2.0.9.1, 2.1.4.1, 2.2.3.1
OpenShift Logging - update to 5.4.11
ruby-rack (Ubuntu package) - addressed in versions Ubuntu Pro, 2.1.4-5ubuntu1.1
rubygem-thread_safe (Red Hat package) - update to 0.3.6-1.el7rhgs
pcs-snmp - update to 0.9.169-3
pcs - update to 0.9.169-3
pcs (Red Hat package) - update to 0.9.169-3.el7_9.3
rubygem-mustermann (Red Hat package) - update to 1.0.3-1.el7rhgs
rubygem-concurrent-ruby (Red Hat package) - update to 1.1.9-1.el7rhgs
rubygem-tzinfo (Red Hat package) - update to 1.2.10-1.el7rhgs
ruby2.1-rubygem-rack - update to 1.6.13-3.13.1
rubygem-i18n (Red Hat package) - update to 1.9.1-1.el7rhgs
python-django (Red Hat package) - update to 1.11.27-4.el7rhgs
ruby2.5-rubygem-rack-doc - update to 2.0.8-150000.3.6.1
ruby2.5-rubygem-rack - update to 2.0.8-150000.3.6.1
ruby2.5-rubygem-rack-testsuite - update to 2.0.8-150000.3.6.1
rubygem-tilt (Red Hat package) - update to 2.0.11-1.el7rhgs
ruby-rack (Debian package) - update to 2.1.4-3+deb11u1
rubygem-rack-protection (Red Hat package) - update to 2.2.0-1.el7rhgs
rubygem-sinatra (Red Hat package) - update to 2.2.0-1.el7rhgs
dev-ruby/rack - update to 2.2.3.1
rubygem-rack - update to 2.2.3.1-1
rubygem-rack-help - update to 2.2.3.1-1
rubygem-rack - update to 2.2.4-1.el8
rubygem-rack (Red Hat package) - update to 2.2.4-1.el7rhgs
IBM Cloud Pak for Multicloud Management - update to 2.3 FP11
rubygem-nio4r (Red Hat package) - update to 2.3.1-2.el7rhgs
ruby (Red Hat package) - update to 2.4.9-94.el7rhgs
rubygem-bcrypt (Red Hat package) - update to 3.1.12-2.el7rhgs
rubygem-puma (Red Hat package) - update to 4.3.12-1.el7rhgs
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 4.8.8, 5.1.0
rubygem-activesupport (Red Hat package) - update to 5.2.0-1.el7rhgs
rubygem-activemodel (Red Hat package) - update to 5.2.0-1.el7rhgs
grafana (Red Hat package) - update to 5.2.4-6.el7rhgs
Contrail Cloud - update to 16.3.0

• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2022-30123.yml
• https://github.com/rack/rack/commit/b426cc224908ec6ed6eb8729325392b048215d88

• Multiple vulnerabilities in Rubygem Rack
• SUSE update for rubygem-rack
• SUSE update for rubygem-rack
• Red Hat Enterprise Linux 7 update for pcs
• Multiple vulnerabilities in Red Hat OpenShift Logging 5.4
• Ubuntu update for ruby-rack
• Multiple vulnerabilities in Red Hat Gluster Storage 3.5 for RHEL 7
• Multiple vulnerabilities in Juniper Networks Contrail Cloud
• Multiple vulnerabilities in Oracle Linux
• Debian update for ruby-rack
• Gentoo update for Rack
• openEuler update for rubygem-rack
• Ubuntu update for ruby-rack
• Fedora EPEL 8 update for rubygem-rack
• Multiple vulnerabilities in IBM Watson Discovery
• Anolis OS update for pcs
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management