CVE-2019-5420 Use of Insufficiently Random Values in Railties Allows Remote Code Execution
Attackers can achieve remote code execution in Rails development mode by guessing the secret token and exploiting internal mechanisms.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-5420?
CVE-2019-5420 is a critical code injection vulnerability in Debian Debian Linux, published on 27 Mar 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalate to a remote code execution exploit.
Which versions are affected by CVE-2019-5420?
2 open source packages ship an affected version, including railties. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
railties RubyGems | From 5.2.0 | 5.2.2.1 |
railties RubyGems | From 5.2.0 | 5.2.2.1 |
Products include Debian Debian Linux, Fedoraproject Fedora, Rubyonrails Rails.
How do I fix CVE-2019-5420?
Upgrade railties to 5.2.2.1 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2019-5420 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-5420 exists.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry and 12 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2019-5420, GHSA-m42h-mh85-4qgc.