CVE-2016-2098
published 2016-04-07CVE-2016-2098: Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by…
PriorityP277high7.3CVSS 3.0
AVNACLPRNUINSUCLILAL
EXPLOIT
EPSS
81.45%
99.6th percentile
Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.
Affected
44 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| actionpack_project | actionpack | >= 3.0.0 < 3.2.22.2 | 3.2.22.2 |
| actionpack_project | actionpack | >= 4.0.0 < 4.1.14.2 | 4.1.14.2 |
| actionpack_project | actionpack | >= 4.2.0 < 4.2.5.2 | 4.2.5.2 |
| debian | debian_linux | — | — |
| debian | rails | < rails 2:4.2.5.2-1 (bookworm) | rails 2:4.2.5.2-1 (bookworm) |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect GET requests with Content-Type: application/json containing a JSON body with an 'inline' key whose value contains ERB template syntax (e.g., <%= ... %>), targeting Rails application endpoints. ↗
- →Look for HTTP requests where a parameter value is a JSON object containing the key 'inline' — this is the attack vector used to pass ERB templates to the Rails render method. ↗
- →Flag Rails controller code that passes user-controlled params directly to render without validation, e.g., `render params[:id]` — this is the vulnerable code pattern. ↗
- →No error condition is logged by the Rails runtime when this exploit succeeds, so absence of application errors does not indicate absence of exploitation. ↗
- ·Only Rails applications that pass unverified/untrusted user input directly to the `render` method are exploitable; applications that validate input before passing to render are not affected. ↗
- ·Rails 5.0 and above are not affected by this vulnerability. ↗
- ·The exploit is delivered as a GET request with a JSON body, which is an unusual combination — WAF or logging rules that ignore GET request bodies may miss this attack. ↗
CVSS provenance
nvdv3.07.3HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv7.3HIGH
vendor_debian7.3HIGH
vendor_redhat7.3HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
actionpack allows remote code execution via application's unrestricted use of render method
ghsa·2017-10-24
CVE-2016-2098 [HIGH] CWE-20 actionpack allows remote code execution via application's unrestricted use of render method
actionpack allows remote code execution via application's unrestricted use of render method
Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.
OSV
actionpack allows remote code execution via application's unrestricted use of render method
osv·2017-10-24
CVE-2016-2098 [HIGH] actionpack allows remote code execution via application's unrestricted use of render method
actionpack allows remote code execution via application's unrestricted use of render method
Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.
OSV
CVE-2016-2098: Action Pack in Ruby on Rails before 3
osv·2016-04-07·CVSS 7.3
CVE-2016-2098 [HIGH] CVE-2016-2098: Action Pack in Ruby on Rails before 3
Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.
Red Hat
rubygem-actionpack: code injection vulnerability in Action View
vendor_redhat·2016-02-29·CVSS 7.3
CVE-2016-2098 [HIGH] CWE-94 rubygem-actionpack: code injection vulnerability in Action View
rubygem-actionpack: code injection vulnerability in Action View
Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.
A code injection flaw was found in the way Action View component searched for templates for rendering. If an application passed untrusted input to the 'render' method, a remote, unauthenticated attacker could use this flaw to execute arbitrary code.
Package: ruby193-rubygem-actionpack (CloudForms Management Engine 5.2) - Affected
Package: ruby193-rubygem-actionpack (CloudForms Management Engine 5.3) - Affected
Package: rh-ror42-rubygem-actionview (Red Hat Software Collections) - Not affected
Package: ruby193
Debian
CVE-2016-2098: rails - Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x bef...
vendor_debian·2016·CVSS 7.3
CVE-2016-2098 [HIGH] CVE-2016-2098: rails - Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x bef...
Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.
Scope: local
bookworm: resolved (fixed in 2:4.2.5.2-1)
bullseye: resolved (fixed in 2:4.2.5.2-1)
forky: resolved (fixed in 2:4.2.5.2-1)
sid: resolved (fixed in 2:4.2.5.2-1)
trixie: resolved (fixed in 2:4.2.5.2-1)
No detection rules found.
Exploit-DB
Ruby on Rails ActionPack Inline ERB - Code Execution (Metasploit)
exploitdb·2016-07-11
CVE-2016-2098 Ruby on Rails ActionPack Inline ERB - Code Execution (Metasploit)
Ruby on Rails ActionPack Inline ERB - Code Execution (Metasploit)
---
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class MetasploitModule 'Ruby on Rails ActionPack Inline ERB Code Execution',
'Description' => %q{
This module exploits a remote code execution vulnerability in the
inline request processor of the Ruby on Rails ActionPack component.
This vulnerability allows an attacker to process ERB to the inline
JSON processor, which is then rendered, permitting full RCE within
the runtime, without logging an error condition.
},
'Author' =>
[
'RageLtMan '
],
'License' => MSF_LICENSE,
'References' =>
[
[ 'CVE', '2016-2098' ]
],
'Platform' => 'ruby',
'Arch' => ARCH_RUBY,
'Privileg
Metasploit
Ruby on Rails ActionPack Inline ERB Code Execution
metasploit
Ruby on Rails ActionPack Inline ERB Code Execution
Ruby on Rails ActionPack Inline ERB Code Execution
This module exploits a remote code execution vulnerability in the inline request processor of the Ruby on Rails ActionPack component. This vulnerability allows an attacker to process ERB to the inline JSON processor, which is then rendered, permitting full RCE within the runtime, without logging an error condition.
HackerOne
Remote code execution using render :inline
hackerone·2016-03-01·CVSS 7.3
CVE-2016-2098 [HIGH] Remote code execution using render :inline
Remote code execution using render :inline
# Possible remote code execution vulnerability in Action Pack.
There is a possible remote code execution vulnerability in Action Pack.
This vulnerability has been assigned the CVE identifier CVE-2016-2098.
Versions Affected: 3.2.x, 4.0.x, 4.1.x, 4.2.x
Not affected: 5.0+
Fixed Versions: 3.2.22.2, 4.1.14.2, 4.2.5.2
Impact
Applications that pass unverified user input to the `render` method in a
controller or a view may be vulnerable to a code injection.
Impacted code will look like this:
```ruby
class TestController < ApplicationController
def show
render params[:id]
end
end
```
An attacker could use the request parameters to coerce the above example
to execute arbitrary ruby code.
All users running an affected release should either upgrade o
Bugzilla
CVE-2016-2098 rubygem-actionpack: Code injection vulnerability in Action Pack [epel-5]
bugzilla·2016-03-01·CVSS 7.3
CVE-2016-2098 [HIGH] CVE-2016-2098 rubygem-actionpack: Code injection vulnerability in Action Pack [epel-5]
CVE-2016-2098 rubygem-actionpack: Code injection vulnerability in Action Pack [epel-5]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
[bug automatically created by: add-trackin
Bugzilla
CVE-2016-2098 rubygem-actionpack: Code injection vulnerability in Action Pack [fedora-all]
bugzilla·2016-03-01·CVSS 7.3
CVE-2016-2098 [HIGH] CVE-2016-2098 rubygem-actionpack: Code injection vulnerability in Action Pack [fedora-all]
CVE-2016-2098 rubygem-actionpack: Code injection vulnerability in Action Pack [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported
Bugzilla
CVE-2016-2098 rubygem-actionview, rubygem-actionpack: code injection vulnerability in Action View
bugzilla·2016-02-19·CVSS 7.3
CVE-2016-2098 [HIGH] CVE-2016-2098 rubygem-actionview, rubygem-actionpack: code injection vulnerability in Action View
CVE-2016-2098 rubygem-actionview, rubygem-actionpack: code injection vulnerability in Action View
Code injection vulnerability in Action Pack was found, possibly leading to remote code execution. Applications that pass unverified user input to the `render` method in a controller may be vulnerable to a code injection.
Impacted code will look like this:
```ruby
class TestController < ApplicationController
def show
render params[:id]
end
end
```
Carefully crafted request parameters, can be used to coerce the above example to execute arbitrary ruby code.
A workaround to this issue is to not pass arbitrary user input to the `render`
method. Instead, verify that data before passing it to the `render` method.
Versions Affected: 3.2.x, 4.0.x, 4.1.x, 4.2.x
Not affected: 5.0+
Fixed Versions: 3
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00057.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00080.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00083.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00086.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-04/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.htmlhttp://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released/http://www.debian.org/security/2016/dsa-3509http://www.securityfocus.com/bid/83725http://www.securitytracker.com/id/1035122https://groups.google.com/forum/message/raw?msg=rubyonrails-security/ly-IH-fxr_Q/WLoOhcMZIAAJhttps://www.exploit-db.com/exploits/40086/http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00057.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00080.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00083.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00086.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-04/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.htmlhttp://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released/http://www.debian.org/security/2016/dsa-3509http://www.securityfocus.com/bid/83725http://www.securitytracker.com/id/1035122https://groups.google.com/forum/message/raw?msg=rubyonrails-security/ly-IH-fxr_Q/WLoOhcMZIAAJhttps://www.exploit-db.com/exploits/40086/
2016-04-07
Published