CVE-2020-8165
published 2020-06-19CVE-2020-8165: A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects…
PriorityP269critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
45.73%
98.7th percentile
A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | rails | < rails 2:5.2.4.3+dfsg-1 (bookworm) | rails 2:5.2.4.3+dfsg-1 (bookworm) |
| https | github.com_rails_rails | — | — |
| opensuse | leap | — | — |
| opensuse | leap | — | — |
| rubyonrails | rails | < 5.2.4.3 | 5.2.4.3 |
| rubyonrails | rails | >= 0 < 2:5.2.4.3+dfsg-1 | 2:5.2.4.3+dfsg-1 |
| rubyonrails | rails | >= 0 < 2:5.2.4.3+dfsg-1 | 2:5.2.4.3+dfsg-1 |
| rubyonrails | rails | >= 0 < 2:5.2.4.3+dfsg-1 | 2:5.2.4.3+dfsg-1 |
| rubyonrails | rails | >= 0 < 2:5.2.4.3+dfsg-1 | 2:5.2.4.3+dfsg-1 |
| rubyonrails | rails | >= 6.0.0 < 6.0.3.1 | 6.0.3.1 |
Detection & IOCsextracted from sources · hover to see the quote
- →Audit application code for any cache write calls that combine user-controlled input with `raw: true` in MemCacheStore or RedisCacheStore — these are the exploitable call sites. ↗
- →Patch commits for Rails 6.0.3.1 and 5.2.4.3 can be used as reference diffs to build detection rules or confirm patched state. ↗
- ·Red Hat Gluster Storage 3 ships the affected rubygem-activesupport but does NOT use the `raw` option when storing untrusted user input, reducing practical exploitability in that product. ↗
- ·Red Hat Satellite uses RedisCacheStore with the affected gem, but unmarshalling of user-provided objects is handled safely in product code, so it is not considered vulnerable. ↗
- ·OpenShift Container Platform 3.11 ships rubygem-activesupport in the logging-fluentd container for rubygem-kubeclient, but kubeclient only uses the inflector portion of activesupport and does NOT invoke the vulnerable cache store class. ↗
- ·No practical mitigation short of patching has been identified; upgrading to rails >= 5.2.4.3 or >= 6.0.3.1 is the only effective remediation. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2020-8165: A deserialization of untrusted data vulnernerability exists in rails < 5
osv·2020-06-19·CVSS 9.8
CVE-2020-8165 [CRITICAL] CVE-2020-8165: A deserialization of untrusted data vulnernerability exists in rails < 5
A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE.
OSV
ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
osv·2020-05-26
CVE-2020-8165 [CRITICAL] ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
In ActiveSupport, there is potentially unexpected behaviour in the MemCacheStore and RedisCacheStore where, when
untrusted user input is written to the cache store using the `raw: true` parameter, re-reading the result
from the cache can evaluate the user input as a Marshalled object instead of plain text. Vulnerable code looks like:
```
data = cache.fetch("demo", raw: true) { untrusted_string }
```
Versions Affected: rails = 5.2.4.3, rails >= 6.0.3.1
Impact
Unmarshalling of untrusted user input can have impact up to and including RCE. At a minimum,
this vulnerability allows an attacker to inject untrusted Ruby objects into a web application.
In addition to upgrading to the l
GHSA
ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
ghsa·2020-05-26
CVE-2020-8165 [CRITICAL] CWE-502 ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
In ActiveSupport, there is potentially unexpected behaviour in the MemCacheStore and RedisCacheStore where, when
untrusted user input is written to the cache store using the `raw: true` parameter, re-reading the result
from the cache can evaluate the user input as a Marshalled object instead of plain text. Vulnerable code looks like:
```
data = cache.fetch("demo", raw: true) { untrusted_string }
```
Versions Affected: rails = 5.2.4.3, rails >= 6.0.3.1
Impact
Unmarshalling of untrusted user input can have impact up to and including RCE. At a minimum,
this vulnerability allows an attacker to inject untrusted Ruby objects into a web application.
In addition to upgrading to the l
Red Hat
rubygem-activesupport: potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
vendor_redhat·2020-05-18·CVSS 9.8
CVE-2020-8165 [CRITICAL] CWE-20 rubygem-activesupport: potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
rubygem-activesupport: potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE.
A flaw was found in rubygem-activesupport. An untrusted user input can be written to the cache store using the `raw: true` parameter which can lead to the result being evaluated as a marshaled object instead of plain text. The threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Statement: This issue affects the version of rubygem-activesupport as shipped with Red Hat Gluster Storage 3. Howeve
Debian
CVE-2020-8165: rails - A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, ...
vendor_debian·2020·CVSS 9.8
CVE-2020-8165 [CRITICAL] CVE-2020-8165: rails - A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, ...
A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE.
Scope: local
bookworm: resolved (fixed in 2:5.2.4.3+dfsg-1)
bullseye: resolved (fixed in 2:5.2.4.3+dfsg-1)
forky: resolved (fixed in 2:5.2.4.3+dfsg-1)
sid: resolved (fixed in 2:5.2.4.3+dfsg-1)
trixie: resolved (fixed in 2:5.2.4.3+dfsg-1)
No detection rules found.
No public exploits indexed.
CTF
medium / README
ctf_writeups·CVSS 9.1
[CRITICAL] medium / README
---
layout: default
title: Medium Machines
parent: Machines
nav_order: 2
description: "112+ Medium HTB machine writeups with walkthroughs"
permalink: /machines/medium/
---
# HackTheBox - Medium Machines
> Comprehensive index of retired HTB Medium-difficulty machines with key techniques and attack path summaries.
**Total: 100+ machines** | Sorted roughly by retirement date (newest first)
---
## Machine Index
| # | Machine | OS | Key Techniques | Attack Path Summary | Writeup |
|---|---------|-----|----------------|---------------------|---------|
| 1 | Signed | Linux | Code Signing Bypass, Certificate Abuse | Forge code signature to deploy malicious update, escalate via trusted binary execution | [0xdf](https://0xdf.gitlab.io/2026/02/07/htb-signed.html) |
| 2 | Voleur | Linux | Data E
Bugzilla
CVE-2020-8165 rubygem-activesupport: potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
bugzilla·2020-06-02·CVSS 9.8
CVE-2020-8165 [CRITICAL] CVE-2020-8165 rubygem-activesupport: potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
CVE-2020-8165 rubygem-activesupport: potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
There is potentially unexpected behaviour in the MemCacheStore and RedisCacheStore where, when untrusted user input is written to the cache store using the `raw: true` parameter, re-reading the result from the cache can evaluate the user input as a marshalled object instead of plain text.
Reference:
https://groups.google.com/forum/#!msg/rubyonrails-security/bv6fW4S0Y1c/KnkEqM7AAQAJ
Discussion:
Created rubygem-activesupport tracking bugs for this issue:
Affects: epel-7 [bug 1843074]
Affects: fedora-all [bug 1843073]
---
External References:
https://groups.google.com/forum/#!msg/rubyonrails-security/bv6fW4S0Y1c/KnkEqM7AAQAJ
---
Upstream patches:
[
Bugzilla
CVE-2020-8165 rubygem-activesupport: potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore [fedora-all]
bugzilla·2020-06-02·CVSS 9.8
CVE-2020-8165 [CRITICAL] CVE-2020-8165 rubygem-activesupport: potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore [fedora-all]
CVE-2020-8165 rubygem-activesupport: potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpk
Bugzilla
CVE-2020-8165 rubygem-activesupport: potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore [epel-7]
bugzilla·2020-06-02·CVSS 9.8
CVE-2020-8165 [CRITICAL] CVE-2020-8165 rubygem-activesupport: potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore [epel-7]
CVE-2020-8165 rubygem-activesupport: potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore [epel-7]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-7.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00031.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-10/msg00034.htmlhttps://groups.google.com/g/rubyonrails-security/c/bv6fW4S0Y1chttps://hackerone.com/reports/413388https://lists.debian.org/debian-lts-announce/2020/06/msg00022.htmlhttps://lists.debian.org/debian-lts-announce/2020/07/msg00013.htmlhttps://weblog.rubyonrails.org/2020/5/18/Rails-5-2-4-3-and-6-0-3-1-have-been-released/https://www.debian.org/security/2020/dsa-4766http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00031.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-10/msg00034.htmlhttps://groups.google.com/g/rubyonrails-security/c/bv6fW4S0Y1chttps://hackerone.com/reports/413388https://lists.debian.org/debian-lts-announce/2020/06/msg00022.htmlhttps://lists.debian.org/debian-lts-announce/2020/07/msg00013.htmlhttps://security.netapp.com/advisory/ntap-20250509-0002/https://weblog.rubyonrails.org/2020/5/18/Rails-5-2-4-3-and-6-0-3-1-have-been-released/https://www.debian.org/security/2020/dsa-4766
2020-06-19
Published