CVE-2022-32224
published 2022-12-05CVE-2022-32224: A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2.8.1 which could…
PriorityP357critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
2.39%
82.1th percentile
A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2.8.1 which could allow an attacker, that can manipulate data in the database (via means like SQL injection), the ability to escalate to an RCE.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| activerecord_project | activerecord | < 5.2.8.1 | 5.2.8.1 |
| activerecord_project | activerecord | >= 0 < 5.2.8.1 | 5.2.8.1 |
| activerecord_project | activerecord | >= 6.0.0 < 6.0.5.1 | 6.0.5.1 |
| activerecord_project | activerecord | >= 6.0.0 < 6.0.5.1 | 6.0.5.1 |
| activerecord_project | activerecord | >= 6.1.0 < 6.1.6.1 | 6.1.6.1 |
| activerecord_project | activerecord | >= 6.1.0 < 6.1.6.1 | 6.1.6.1 |
| activerecord_project | activerecord | >= 7.0.0 < 7.0.3.1 | 7.0.3.1 |
| activerecord_project | activerecord | >= 7.0.0 < 7.0.3.1 | 7.0.3.1 |
| debian | rails | < rails 2:6.1.6.1+dfsg-1 (bookworm) | rails 2:6.1.6.1+dfsg-1 (bookworm) |
| https | github.com_rails_rails | — | — |
| rubyonrails | rails | >= 0 < 2:6.1.6.1+dfsg-1 | 2:6.1.6.1+dfsg-1 |
| rubyonrails | rails | >= 0 < 2:6.1.6.1+dfsg-1 | 2:6.1.6.1+dfsg-1 |
| rubyonrails | rails | >= 0 < 2:6.1.6.1+dfsg-1 | 2:6.1.6.1+dfsg-1 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
activerecord: Possible RCE escalation bug with Serialized Columns in Active Record
vendor_redhat·2022-07-12·CVSS 9.8
CVE-2022-32224 [CRITICAL] CWE-94 activerecord: Possible RCE escalation bug with Serialized Columns in Active Record
activerecord: Possible RCE escalation bug with Serialized Columns in Active Record
A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2.8.1 which could allow an attacker, that can manipulate data in the database (via means like SQL injection), the ability to escalate to an RCE.
An insecure deserialization flaw was found in Active Record, which uses YAML.unsafe_load to convert the YAML data into Ruby objects. An attacker supplying crafted data to the database can perform remote code execution (RCE), resulting in complete system compromise.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease o
Debian
CVE-2022-32224: rails - A possible escalation to RCE vulnerability exists when using YAML serialized col...
vendor_debian·2022·CVSS 9.8
CVE-2022-32224 [CRITICAL] CVE-2022-32224: rails - A possible escalation to RCE vulnerability exists when using YAML serialized col...
A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2.8.1 which could allow an attacker, that can manipulate data in the database (via means like SQL injection), the ability to escalate to an RCE.
Scope: local
bookworm: resolved (fixed in 2:6.1.6.1+dfsg-1)
bullseye: open
forky: resolved (fixed in 2:6.1.6.1+dfsg-1)
sid: resolved (fixed in 2:6.1.6.1+dfsg-1)
trixie: resolved (fixed in 2:6.1.6.1+dfsg-1)
OSV
CVE-2022-32224: A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7
osv·2022-12-05·CVSS 9.8
CVE-2022-32224 [CRITICAL] CVE-2022-32224: A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7
A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2.8.1 which could allow an attacker, that can manipulate data in the database (via means like SQL injection), the ability to escalate to an RCE.
GHSA
Active Record RCE bug with Serialized Columns
ghsa·2022-07-12
CVE-2022-32224 [CRITICAL] CWE-502 Active Record RCE bug with Serialized Columns
Active Record RCE bug with Serialized Columns
When serialized columns that use YAML (the default) are deserialized, Rails uses YAML.unsafe_load to convert the YAML data in to Ruby objects. If an attacker can manipulate data in the database (via means like SQL injection), then it may be possible for the attacker to escalate to an RCE.
There are no feasible workarounds for this issue, but other coders (such as JSON) are not impacted.
OSV
Active Record RCE bug with Serialized Columns
osv·2022-07-12
CVE-2022-32224 [CRITICAL] Active Record RCE bug with Serialized Columns
Active Record RCE bug with Serialized Columns
When serialized columns that use YAML (the default) are deserialized, Rails uses YAML.unsafe_load to convert the YAML data in to Ruby objects. If an attacker can manipulate data in the database (via means like SQL injection), then it may be possible for the attacker to escalate to an RCE.
There are no feasible workarounds for this issue, but other coders (such as JSON) are not impacted.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-12-05
Published