CVE-2022-32224 Active Record RCE bug with Serialized Columns
Attackers with database write access can achieve remote code execution via unsafe YAML deserialization in Active Record columns.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-32224?
CVE-2022-32224 is a critical unsafe deserialization vulnerability in https://github.com/rails/rails, published on 5 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2.8.1 which could allow an attacker, that can manipulate data in the database (via means like SQL injection), the ability to escalate to an RCE.
Weakness: CWE-502
Which versions are affected by CVE-2022-32224?
8 open source packages ship an affected version, including activerecord. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
activerecord RubyGems | All versions | 5.2.8.1 |
activerecord RubyGems | All versions | 5.2.8.1 |
activerecord RubyGems | From 6.0.0 | 6.0.5.1 |
activerecord RubyGems | From 6.0.0 | 6.0.5.1 |
activerecord RubyGems | From 6.1.0 | 6.1.6.1 |
activerecord RubyGems | From 6.1.0 | 6.1.6.1 |
2 more packages
activerecord RubyGems | From 7.0.0 | 7.0.3.1 |
activerecord RubyGems | From 7.0.0 | 7.0.3.1 |
Linux distribution packages (4)
rubygem-activerecord-5.2 SUSE:Package Hub 15 SP4 | All versions | 5.2.3-bp154.2.3.1 |
rubygem-activerecord-5.2 openSUSE:Leap 15.4 | All versions | 5.2.3-bp154.2.3.1 |
ruby3.2-rubygem-activerecord-7.0 openSUSE:Tumbleweed | All versions | 7.0.4.3-1.1 |
rubygem-activerecord-7.0 openSUSE:Tumbleweed | All versions | 7.0.3.1-1.1 |
Products include Activerecord Project Activerecord.
How do I fix CVE-2022-32224?
Upgrade activerecord to a fixed version for your release line: 5.2.8.1, 6.0.5.1, 6.1.6.1 or 7.0.3.1.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2022-32224 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-32224 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in https://github.com/rails/rails
Sources
Also known as DEBIAN-CVE-2022-32224, GHSA-3hhc-qp5v-9p2j, UBUNTU-CVE-2022-32224, openSUSE-SU-2023:0009-1, openSUSE-SU-2024:12244-1, openSUSE-SU-2024:12879-1.