CVE-2020-8164
published 2020-06-19CVE-2020-8164: A deserialization of untrusted data vulnerability exists in rails < 5.2.4.3, rails < 6.0.3.1 which can allow an attacker to supply information can be…
PriorityP343high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
4.20%
89.8th percentile
A deserialization of untrusted data vulnerability exists in rails < 5.2.4.3, rails < 6.0.3.1 which can allow an attacker to supply information can be inadvertently leaked fromStrong Parameters.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| actionpack_project | actionpack | >= 5.0.0 < 5.2.4.3 | 5.2.4.3 |
| actionpack_project | actionpack | >= 6.0.0 < 6.0.3.1 | 6.0.3.1 |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | rails | < rails 2:5.2.4.3+dfsg-1 (bookworm) | rails 2:5.2.4.3+dfsg-1 (bookworm) |
| https | github.com_rails_rails | — | — |
| opensuse | backports_sle | — | — |
| opensuse | leap | — | — |
| opensuse | leap | — | — |
| rubyonrails | rails | < 5.2.4.3 | 5.2.4.3 |
| rubyonrails | rails | >= 0 < 2:5.2.4.3+dfsg-1 | 2:5.2.4.3+dfsg-1 |
| rubyonrails | rails | >= 0 < 2:5.2.4.3+dfsg-1 | 2:5.2.4.3+dfsg-1 |
| rubyonrails | rails | >= 0 < 2:5.2.4.3+dfsg-1 | 2:5.2.4.3+dfsg-1 |
| rubyonrails | rails | >= 0 < 2:5.2.4.3+dfsg-1 | 2:5.2.4.3+dfsg-1 |
| rubyonrails | rails | >= 6.0.0 < 6.0.3.1 | 6.0.3.1 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2020-8164: A deserialization of untrusted data vulnerability exists in rails < 5
osv·2020-06-19·CVSS 7.5
CVE-2020-8164 [HIGH] CVE-2020-8164: A deserialization of untrusted data vulnerability exists in rails < 5
A deserialization of untrusted data vulnerability exists in rails < 5.2.4.3, rails < 6.0.3.1 which can allow an attacker to supply information can be inadvertently leaked fromStrong Parameters.
OSV
Possible Strong Parameters Bypass in ActionPack
osv·2020-05-26
CVE-2020-8164 [HIGH] Possible Strong Parameters Bypass in ActionPack
Possible Strong Parameters Bypass in ActionPack
There is a strong parameters bypass vector in ActionPack.
Versions Affected: rails = 5.2.4.3, rails >= 6.0.3.1
Impact
In some cases user supplied information can be inadvertently leaked from
Strong Parameters. Specifically the return value of `each`, or `each_value`,
or `each_pair` will return the underlying "untrusted" hash of data that was
read from the parameters. Applications that use this return value may be
inadvertently use untrusted user input.
Impacted code will look something like this:
```
def update
# Attacker has included the parameter: `{ is_admin: true }`
User.update(clean_up_params)
end
def clean_up_params
params.each { |k, v| SomeModel.check(v) if k == :name }
end
```
Note the mistaken use of `each` in the `clean_up_pa
GHSA
Possible Strong Parameters Bypass in ActionPack
ghsa·2020-05-26
CVE-2020-8164 [HIGH] CWE-502 Possible Strong Parameters Bypass in ActionPack
Possible Strong Parameters Bypass in ActionPack
There is a strong parameters bypass vector in ActionPack.
Versions Affected: rails = 5.2.4.3, rails >= 6.0.3.1
Impact
In some cases user supplied information can be inadvertently leaked from
Strong Parameters. Specifically the return value of `each`, or `each_value`,
or `each_pair` will return the underlying "untrusted" hash of data that was
read from the parameters. Applications that use this return value may be
inadvertently use untrusted user input.
Impacted code will look something like this:
```
def update
# Attacker has included the parameter: `{ is_admin: true }`
User.update(clean_up_params)
end
def clean_up_params
params.each { |k, v| SomeModel.check(v) if k == :name }
end
```
Note the mistaken use of `each` in the `clean_up_pa
Red Hat
rubygem-actionpack: possible strong parameters bypass
vendor_redhat·2020-05-18·CVSS 7.5
CVE-2020-8164 [HIGH] CWE-200 rubygem-actionpack: possible strong parameters bypass
rubygem-actionpack: possible strong parameters bypass
A deserialization of untrusted data vulnerability exists in rails < 5.2.4.3, rails < 6.0.3.1 which can allow an attacker to supply information can be inadvertently leaked fromStrong Parameters.
A flaw was found in rubygem-actionpack. Untrusted hashes of data is possible for values of `each`, `each_value`, and `each_pair` which can lead to cases of user supplied information being leaked from Strong Parameters. Applications that use these hashes may inadvertently use untrusted user input. The highest risk from this vulnerability is to data confidentiality.
Statement: Red Hat CloudForms and Red Hat Satellite ship affected RubyGem actionpack and uses strong parameters, however, products are not vulnerable since safe return values are use
Debian
CVE-2020-8164: rails - A deserialization of untrusted data vulnerability exists in rails < 5.2.4.3, rai...
vendor_debian·2020·CVSS 7.5
CVE-2020-8164 [HIGH] CVE-2020-8164: rails - A deserialization of untrusted data vulnerability exists in rails < 5.2.4.3, rai...
A deserialization of untrusted data vulnerability exists in rails < 5.2.4.3, rails < 6.0.3.1 which can allow an attacker to supply information can be inadvertently leaked fromStrong Parameters.
Scope: local
bookworm: resolved (fixed in 2:5.2.4.3+dfsg-1)
bullseye: resolved (fixed in 2:5.2.4.3+dfsg-1)
forky: resolved (fixed in 2:5.2.4.3+dfsg-1)
sid: resolved (fixed in 2:5.2.4.3+dfsg-1)
trixie: resolved (fixed in 2:5.2.4.3+dfsg-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2020-8164 rubygem-actionpack: possible strong parameters bypass
bugzilla·2020-06-01·CVSS 7.5
CVE-2020-8164 [HIGH] CVE-2020-8164 rubygem-actionpack: possible strong parameters bypass
CVE-2020-8164 rubygem-actionpack: possible strong parameters bypass
There is a strong parameters bypass vector in ActionPack. In some cases user supplied information can be inadvertently leaked from Strong Parameters. Specifically the return value of `each`, or `each_value`, or `each_pair` will return the underlying "untrusted" hash of data that was read from the parameters. Applications that use this return value may be inadvertently use untrusted user input.
Reference:
https://groups.google.com/forum/#!msg/rubyonrails-security/f6ioe4sdpbY/s8tBAMPAAQAJ
Discussion:
Created rubygem-actionpack tracking bugs for this issue:
Affects: fedora-all [bug 1842635]
---
External References:
https://weblog.rubyonrails.org/2020/5/18/Rails-5-2-4-3-and-6-0-3-1-have-been-released
---
Statement:
Bugzilla
CVE-2020-8164 rubygem-actionpack: possible strong parameters bypass [fedora-all]
bugzilla·2020-06-01·CVSS 7.5
CVE-2020-8164 [HIGH] CVE-2020-8164 rubygem-actionpack: possible strong parameters bypass [fedora-all]
CVE-2020-8164 rubygem-actionpack: possible strong parameters bypass [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versi
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00089.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-09/msg00093.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-09/msg00107.htmlhttps://groups.google.com/g/rubyonrails-security/c/f6ioe4sdpbYhttps://hackerone.com/reports/292797https://lists.debian.org/debian-lts-announce/2020/06/msg00022.htmlhttps://lists.debian.org/debian-lts-announce/2020/07/msg00013.htmlhttps://www.debian.org/security/2020/dsa-4766http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00089.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-09/msg00093.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-09/msg00107.htmlhttps://groups.google.com/g/rubyonrails-security/c/f6ioe4sdpbYhttps://hackerone.com/reports/292797https://lists.debian.org/debian-lts-announce/2020/06/msg00022.htmlhttps://lists.debian.org/debian-lts-announce/2020/07/msg00013.htmlhttps://www.debian.org/security/2020/dsa-4766
2020-06-19
Published