Debian 8: DLA-2251-1 Moderate: Rails Remote Code Execution Issues

debian lts

June 19, 2020

Two vulnerabilities were found in Ruby on Rails, a MVC ruby-based framework geared for web application development, which could lead to remote code execution and untrusted user inp...

Topics Covered

security advisory remote code execution Debian input validation rails

Summary

CVE-2020-8164

Strong parameters bypass vector in ActionPack. In some cases user
supplied information can be inadvertently leaked from Strong
Parameters. Specifically the return value of `each`, or
`each_value`, or `each_pair` will return the underlying
"untrusted" hash of data that was read from the parameters.
Applications that use this return value may be inadvertently use
untrusted user input.

CVE-2020-8165

Potentially unintended unmarshalling of user-provided objects in
MemCacheStore. There is potentially unexpected behaviour in the
MemCacheStore where, when untrusted user input is written to the
cache store using the `raw: true` parameter, re-reading the result
from the cache can evaluate the user input as a Marshalled object
instead of plain text. Unmarshalling of untrusted user input can
have impact up to and including RCE. At a minimum, this
vulnerability allows an attacker to inject untrusted Ruby objects