CVE-2020-8185
published 2020-07-02CVE-2020-8185: A denial of service vulnerability exists in Rails <6.0.3.2 that allowed an untrusted user to run any pending migrations on a Rails app running in production.
PriorityP429medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
2.18%
80.6th percentile
A denial of service vulnerability exists in Rails <6.0.3.2 that allowed an untrusted user to run any pending migrations on a Rails app running in production.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| actionpack_project | actionpack | >= 6.0.0 < 6.0.3.2 | 6.0.3.2 |
| debian | rails | — | — |
| fedoraproject | fedora | — | — |
| https | github.com_rails_rails | — | — |
| rubyonrails | rails | >= 6.0.0 < 6.0.3.2 | 6.0.3.2 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:N/I:N/A:P
ghsa6.5MEDIUM
osv6.5MEDIUM
vendor_debian6.5LOW
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2020-8185: A denial of service vulnerability exists in Rails <6
osv·2020-07-02·CVSS 6.5
CVE-2020-8185 [MEDIUM] CVE-2020-8185: A denial of service vulnerability exists in Rails <6
A denial of service vulnerability exists in Rails <6.0.3.2 that allowed an untrusted user to run any pending migrations on a Rails app running in production.
OSV
Untrusted users can run pending migrations in production in Rails
osv·2020-06-24·CVSS 6.5
CVE-2020-8185 [MEDIUM] Untrusted users can run pending migrations in production in Rails
Untrusted users can run pending migrations in production in Rails
There is a vulnerability in versions of Rails prior to 6.0.3.2 that allowed an untrusted user to run any pending migrations on a Rails app running in production.
This vulnerability has been assigned the CVE identifier CVE-2020-8185.
Versions Affected: 6.0.0 = 6.0.3.2
Impact
Using this issue, an attacker would be able to execute any migrations that are pending for a Rails app running in production mode. It is important to note that an attacker is limited to running migrations the application developer has already defined in their application and ones that have not already run.
Workarounds
Until such time as the patch can be applied, application developers should disable the ActionDispatch middleware in their production
GHSA
Untrusted users can run pending migrations in production in Rails
ghsa·2020-06-24·CVSS 6.5
CVE-2020-8185 [MEDIUM] CWE-400 Untrusted users can run pending migrations in production in Rails
Untrusted users can run pending migrations in production in Rails
There is a vulnerability in versions of Rails prior to 6.0.3.2 that allowed an untrusted user to run any pending migrations on a Rails app running in production.
This vulnerability has been assigned the CVE identifier CVE-2020-8185.
Versions Affected: 6.0.0 = 6.0.3.2
Impact
Using this issue, an attacker would be able to execute any migrations that are pending for a Rails app running in production mode. It is important to note that an attacker is limited to running migrations the application developer has already defined in their application and ones that have not already run.
Workarounds
Until such time as the patch can be applied, application developers should disable the ActionDispatch middleware in their production
Red Hat
rubygem-rails: untrusted users able to run pending migrations in production
vendor_redhat·2020-06-17·CVSS 6.5
CVE-2020-8185 [MEDIUM] CWE-250 rubygem-rails: untrusted users able to run pending migrations in production
rubygem-rails: untrusted users able to run pending migrations in production
A denial of service vulnerability exists in Rails <6.0.3.2 that allowed an untrusted user to run any pending migrations on a Rails app running in production.
Statement: Red Hat Satellite and Red Hat CloudForms do not ship vulnerable versions of RubyGem Rails hence not affected to the flaw.
Package: cfme-gemset (CloudForms Management Engine 5) - Not affected
Package: tfm-ror52-rubygem-rails (Red Hat Satellite 6) - Not affected
Debian
CVE-2020-8185: rails - A denial of service vulnerability exists in Rails <6.0.3.2 that allowed an untru...
vendor_debian·2020·CVSS 6.5
CVE-2020-8185 [MEDIUM] CVE-2020-8185: rails - A denial of service vulnerability exists in Rails <6.0.3.2 that allowed an untru...
A denial of service vulnerability exists in Rails <6.0.3.2 that allowed an untrusted user to run any pending migrations on a Rails app running in production.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
No detection rules found.
No public exploits indexed.
HackerOne
Open Redirect (6.0.0 < rails < 6.0.3.2)
hackerone·2020-12-22·CVSS 6.5
[MEDIUM] Open Redirect (6.0.0 < rails < 6.0.3.2)
Open Redirect (6.0.0 You are being redirected."
[302, {
"Content-Type" => "text/html; charset=#{Response.default_charset}",
"Content-Length" => body.bytesize.to_s,
"Location" => location,
}, [body]]
end
```
There was an open redirect issue because the request parameter `location` was not validated.
In 6.0.3.2, since the condition of `actionable_request?` has changed, this problem is less likely to occur.
### PoC
#### 1. Prepare server
Prepare an attackable 6.0.3.1 version of Rails server
```
❯ rails -v
Rails 6.0.3.1
❯ RAILS_ENV=production rails s
...
* Environment: production
* Listening on tcp://0.0.0.0:3000
```
#### 2. Attack server
Prepare the server for attack on another port.
```html
click!
````
```
python3 -m http.server 8000
```
#### 3. Open browser
Open the `http:/
Bugzilla
CVE-2020-8185 rubygem-rails: untrusted users able to run pending migrations in production
bugzilla·2020-06-30·CVSS 6.5
CVE-2020-8185 [MEDIUM] CVE-2020-8185 rubygem-rails: untrusted users able to run pending migrations in production
CVE-2020-8185 rubygem-rails: untrusted users able to run pending migrations in production
There is a vulnerability in versions of Rails prior to 6.0.3.2 that allowed an untrusted user to run any pending migrations on a Rails app running in production.
References:
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2020-8185.yml
Discussion:
Created rubygem-rails tracking bugs for this issue:
Affects: fedora-all [bug 1852381]
---
Upstream patch: https://github.com/rails/rails/commit/661da266b94909574426fd1121ef13b800e01b9a
---
External References:
https://weblog.rubyonrails.org/2020/6/17/Rails-6-0-3-2-has-been-released
---
Statement:
Red Hat Satellite and Red Hat CloudForms do not ship vulnerable versions of RubyGem Rails hence not affected to the flaw.
Bugzilla
CVE-2020-8185 rubygem-rails: untrusted users able to run pending migrations in production [fedora-all]
bugzilla·2020-06-30·CVSS 6.5
CVE-2020-8185 [MEDIUM] CVE-2020-8185 rubygem-rails: untrusted users able to run pending migrations in production [fedora-all]
CVE-2020-8185 rubygem-rails: untrusted users able to run pending migrations in production [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects mu
https://groups.google.com/g/rubyonrails-security/c/pAe9EV8gbM0https://hackerone.com/reports/899069https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XJ7NUWXAEVRQCROIIBV4C6WXO6IR3KSB/https://groups.google.com/g/rubyonrails-security/c/pAe9EV8gbM0https://hackerone.com/reports/899069https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XJ7NUWXAEVRQCROIIBV4C6WXO6IR3KSB/
2020-07-02
Published