CVE-2016-2098 actionpack allows remote code execution via application's unrestricted use of render method
Remote attackers can execute arbitrary Ruby code in Rails applications that improperly use the render method without restrictions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-2098?
CVE-2016-2098 is a high-severity code injection vulnerability in Debian Debian Linux, published on 7 Apr 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.
Weakness: CWE-20
Which versions are affected by CVE-2016-2098?
6 open source packages ship an affected version, including actionpack. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
actionpack RubyGems | From 3.0.0 | 3.2.22.2 |
actionpack RubyGems | From 3.0.0 | 3.2.22.2 |
actionpack RubyGems | From 4.0.0 | 4.1.14.2 |
actionpack RubyGems | From 4.0.0 | 4.1.14.2 |
actionpack RubyGems | From 4.2.0 | 4.2.5.2 |
actionpack RubyGems | From 4.2.0 | 4.2.5.2 |
Linux distribution packages (3)
rubygem-actionview-4_2 SUSE:Enterprise Storage 2.1 | All versions | 4.2.2-8.1 |
rubygem-actionview-4_2 SUSE:OpenStack Cloud 6 | All versions | 4.2.2-8.1 |
rubygem-actionview-4_2 openSUSE:Tumbleweed | All versions | 5.0.0.1-1.1 |
Products include Debian Debian Linux, Rubyonrails Rails, Rubyonrails Ruby on Rails.
How do I fix CVE-2016-2098?
Upgrade actionpack to a fixed version for your release line: 3.2.22.2, 4.1.14.2 or 4.2.5.2.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2016-2098 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2016-2098 exists.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry and 12 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2016-2098, GHSA-78rc-8c29-p45g, SUSE-SU-2016:0867-1, openSUSE-SU-2024:10057-1.