CVE-2019-5420
published 2019-03-27CVE-2019-5420: A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development…
PriorityP181critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
89.33%
99.8th percentile
A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalate to a remote code execution exploit.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | rails | < rails 2:5.2.2.1+dfsg-1 (bookworm) | rails 2:5.2.2.1+dfsg-1 (bookworm) |
| fedoraproject | fedora | — | — |
| rails | https_github.com_rails_rails | — | — |
| rails | https_github.com_rails_rails | — | — |
| rubyonrails | rails | < 5.2.2.1 | 5.2.2.1 |
| rubyonrails | rails | — | — |
| rubyonrails | rails | >= 0 < 2:5.2.2.1+dfsg-1 | 2:5.2.2.1+dfsg-1 |
| rubyonrails | rails | >= 0 < 2:5.2.2.1+dfsg-1 | 2:5.2.2.1+dfsg-1 |
| rubyonrails | rails | >= 0 < 2:5.2.2.1+dfsg-1 | 2:5.2.2.1+dfsg-1 |
| rubyonrails | rails | >= 0 < 2:5.2.2.1+dfsg-1 | 2:5.2.2.1+dfsg-1 |
Detection & IOCsextracted from sources · hover to see the quote
- →Attacker probes an invalid/random path under /rails/ to leak Rails.root and derive the application name, which is used as the secret_key_base in development mode. ↗
- →Exploit delivers a signed, serialized (Marshal) payload via a GET request to /rails/active_storage/disk/<payload>/test — monitor for unusually long or base64-like path segments on this route. ↗
- →Exploit drops base64-encoded and binary payload files in /tmp with random .bin names; monitor for unexpected .bin file creation in /tmp by the Rails process. ↗
- →The exploit targets Rails applications running on the default development port 3000; restrict or monitor external access to port 3000. ↗
- →In development mode, Rails uses the application name as the secret_key_base; an attacker can extract the app name from the Rails.root error page and forge signed serialized payloads. ↗
- →The exploit is logged in application logs (IOC_IN_LOGS); review Rails logs for GET requests to /rails/active_storage/disk/ with anomalously large path segments. ↗
- ·Vulnerability only affects Rails applications running in development mode; production deployments with a properly set secret_key_base are not affected. ↗
- ·Red Hat Software Collections versions rh-ror42-rubygem-rails and rh-ror50-rubygem-rails were confirmed not affected as they did not include the vulnerable commit. ↗
- ·The vulnerable behavior was introduced by a specific Rails commit; verify whether the commit is present before treating an installation as affected. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2019-5420: A remote code execution vulnerability in development mode Rails <5
osv·2019-03-27·CVSS 9.8
CVE-2019-5420 [CRITICAL] CVE-2019-5420: A remote code execution vulnerability in development mode Rails <5
A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalate to a remote code execution exploit.
OSV
Use of Insufficiently Random Values in Railties Allows Remote Code Execution
osv·2019-03-13
CVE-2019-5420 [CRITICAL] Use of Insufficiently Random Values in Railties Allows Remote Code Execution
Use of Insufficiently Random Values in Railties Allows Remote Code Execution
# Possible Remote Code Execution Exploit in Rails Development Mode
Impact
With some knowledge of a target application it is possible for an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalate to a remote code execution exploit.
All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases
The 6.0.0.beta3 and 5.2.2.1 releases are available at the normal locations.
Workarounds
This issue can be mitigated by specifying a secret key in development mode.
In "config/environments/development.rb" add this:
```
config.secret_key_base = SecureRandom.hex(64)
```
GHSA
Use of Insufficiently Random Values in Railties Allows Remote Code Execution
ghsa·2019-03-13
CVE-2019-5420 [CRITICAL] CWE-330 Use of Insufficiently Random Values in Railties Allows Remote Code Execution
Use of Insufficiently Random Values in Railties Allows Remote Code Execution
# Possible Remote Code Execution Exploit in Rails Development Mode
Impact
With some knowledge of a target application it is possible for an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalate to a remote code execution exploit.
All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases
The 6.0.0.beta3 and 5.2.2.1 releases are available at the normal locations.
Workarounds
This issue can be mitigated by specifying a secret key in development mode.
In "config/environments/development.rb" add this:
```
config.secret_key_base = SecureRandom.hex(64)
```
Red Hat
rubygem-rails: Weak secret token leading to possible code execution
vendor_redhat·2019-03-13·CVSS 9.8
CVE-2019-5420 [CRITICAL] CWE-338 rubygem-rails: Weak secret token leading to possible code execution
rubygem-rails: Weak secret token leading to possible code execution
A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalate to a remote code execution exploit.
Statement: This issue did not affect the versions of rh-ror42-rubygem-rails and rh-ror50-rubygem-rails as shipped with Red Hat Software Collections.
Package: rh-ror42-rubygem-rails (Red Hat Software Collections) - Not affected
Package: rh-ror50-rubygem-rails (Red Hat Software Collections) - Not affected
Debian
CVE-2019-5420: rails - A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0...
vendor_debian·2019·CVSS 9.8
CVE-2019-5420 [CRITICAL] CVE-2019-5420: rails - A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0...
A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalate to a remote code execution exploit.
Scope: local
bookworm: resolved (fixed in 2:5.2.2.1+dfsg-1)
bullseye: resolved (fixed in 2:5.2.2.1+dfsg-1)
forky: resolved (fixed in 2:5.2.2.1+dfsg-1)
sid: resolved (fixed in 2:5.2.2.1+dfsg-1)
trixie: resolved (fixed in 2:5.2.2.1+dfsg-1)
No detection rules found.
Exploit-DB
Ruby On Rails - DoubleTap Development Mode secret_key_base Remote Code Execution (Metasploit)
exploitdb·2019-05-02·CVSS 9.8
CVE-2019-5420 [CRITICAL] Ruby On Rails - DoubleTap Development Mode secret_key_base Remote Code Execution (Metasploit)
Ruby On Rails - DoubleTap Development Mode secret_key_base Remote Code Execution (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule 'Ruby On Rails DoubleTap Development Mode secret_key_base Vulnerability',
'Description' => %q{
This module exploits a vulnerability in Ruby on Rails. In development mode, a Rails
application would use its name as the secret_key_base, and can be easily extracted by
visiting an invalid resource for a path. As a result, this allows a remote user to
create and deliver a signed serialized payload, load it by the application, and gain
remote code execution.
},
'License' => MSF_LICENSE,
'Author' =>
[
'ooooooo_q', # Reported the vuln on hac
Metasploit
Ruby On Rails DoubleTap Development Mode secret_key_base Vulnerability
metasploit
Ruby On Rails DoubleTap Development Mode secret_key_base Vulnerability
Ruby On Rails DoubleTap Development Mode secret_key_base Vulnerability
This module exploits a vulnerability in Ruby on Rails. In development mode, a Rails application would use its name as the secret_key_base, and can be easily extracted by visiting an invalid resource for a path. As a result, this allows a remote user to create and deliver a signed serialized payload, load it by the application, and gain remote code execution.
Bugzilla
CVE-2019-5420 rubygem-rails: Weak secret token leading to possible code execution
bugzilla·2019-03-15·CVSS 9.8
CVE-2019-5420 [CRITICAL] CVE-2019-5420 rubygem-rails: Weak secret token leading to possible code execution
CVE-2019-5420 rubygem-rails: Weak secret token leading to possible code execution
With some knowledge of a target application it is possible for an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalate to a remote code execution exploit.
External References:
https://groups.google.com/d/msg/rubyonrails-security/IsQKvDqZdKw/UYgRCJz2CgAJ
Discussion:
Created rubygem-rails tracking bugs for this issue:
Affects: fedora-all [bug 1689155]
---
References:
https://seclists.org/oss-sec/2019/q1/176
---
Looks like this was introduced via https://github.com/rails/rails/commit/69f976b859cae7f9d050152103da018b7f5dda6d
The versions we ship do not contain this change yet and are not affecte
Bugzilla
CVE-2019-5420 rubygem-rails: Weak secret token leading to possible code execution [fedora-all]
bugzilla·2019-03-15·CVSS 9.8
CVE-2019-5420 [CRITICAL] CVE-2019-5420 rubygem-rails: Weak secret token leading to possible code execution [fedora-all]
CVE-2019-5420 rubygem-rails: Weak secret token leading to possible code execution [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple s
Trailofbits
Marshal madness: A brief history of Ruby deserialization exploits
blogs_trailofbits·2025-08-20
Marshal madness: A brief history of Ruby deserialization exploits
Documenting the evolution of exploitation techniques serves a crucial purpose in security engineering: it helps us understand not just individual vulnerabilities but the systemic patterns that resist conventional fixes. The story of deserialization exploits in Ruby’s Marshal module offers a uniquely well-documented case study of this phenomenon. That is, a decade-long cycle of patches and bypasses that reveals the futility of addressing symptoms rather than root causes.
This history matters because it demonstrates why certain classes of vulnerabilities persist despite our best efforts. By tracing how we got here, we can better understand why fundamental changes to the Ruby ecosystem are necessary, rather than continued reliance on the patch-and-hope approach that has thus far failed to so
Trailofbits
Marshal madness: A brief history of Ruby deserialization exploits
blogs_trailofbits·2025-08-19
Marshal madness: A brief history of Ruby deserialization exploits
Documenting the evolution of exploitation techniques serves a crucial purpose in security engineering: it helps us understand not just individual vulnerabilities but the systemic patterns that resist conventional fixes. The story of deserialization exploits in Ruby’s Marshal module offers a uniquely well-documented case study of this phenomenon. That is, a decade-long cycle of patches and bypasses that reveals the futility of addressing symptoms rather than root causes.
This history matters because it demonstrates why certain classes of vulnerabilities persist despite our best efforts. By tracing how we got here, we can better understand why fundamental changes to the Ruby ecosystem are necessary, rather than continued reliance on the patch-and-hope approach that has thus far failed to so
http://packetstormsecurity.com/files/152704/Ruby-On-Rails-DoubleTap-Development-Mode-secret_key_base-Remote-Code-Execution.htmlhttps://groups.google.com/forum/#%21topic/rubyonrails-security/IsQKvDqZdKwhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA/https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/https://www.exploit-db.com/exploits/46785/http://packetstormsecurity.com/files/152704/Ruby-On-Rails-DoubleTap-Development-Mode-secret_key_base-Remote-Code-Execution.htmlhttps://groups.google.com/forum/#%21topic/rubyonrails-security/IsQKvDqZdKwhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA/https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/https://www.exploit-db.com/exploits/46785/
2019-03-27
Published