Overview
Ruby on Rails (often called Rails) is a web application framework written in Ruby that emphasizes convention over configuration and the principle of "don't repeat yourself" (DRY). It provides developers with a structured and efficient way to build database-backed web applications through pre-built patterns for rapid development.
WIth this vulnerability, it is possible to guess the token automatically generated by the Action Job gem thereby allowing a malicious actor to perform path traversal and, ultimately, possibly execute remote code.
Remote code execution flaws are among the Top 10 Open Web Application Security Project (OWASP) vulnerabilities. They are among the most potentially damaging of vulnerabilities because injected, remotely executed code:
- can access internal application objects/methods
- can often bypass security controls
- may persist across sessions
- can often pivot to gain OS-level access.
All users running an affected release should apply the workaround or upgrade immediately.
Details
Module Info
- Product: Ruby on Rails Framework
- Affected packages: actionjob
- GitHub repository:
https://github.com/rails/rails - Published package: The individual activejob gem or the entire Rails Framework gem (which includes activejob).
- Package manager: gem
Vulnerability Info
The development token (secret_key_base) in Rails is normally used to verify that requests to view error pages in development mode are coming from legitimate local development sessions. It helps prevent unauthorized users from accessing potentially sensitive debugging information that might be exposed in error pages and logs while developers are working on the application locally.
This exploit is a path traversal vulnerability in which the lack of a specified file format is overly permissive when reading files using this mechanism.
The workaround specified below ensures that only the developer can generate tokens that correspond with the hash value assigned to secret_key_base.
Workarounds
This issue can be mitigated by specifying a secret key in development mode. In "config/environments/development.rb" add the following assignment:
config.secret_key_base = SecureRandom.hex(64)
Credits
Mitigation
Users of affected versions of Ruby on Rails should follow one of the following mitigations:
- Upgrade to a corrected version.
- Leverage a commercial support partner like HeroDevs for post-EOL security support.
