CVE-2019-16255
📋 TL;DR
This vulnerability allows remote code execution in Ruby applications using the Shell#[] or Shell#test methods with untrusted input. Attackers can inject arbitrary Ruby code to execute commands on the system. Affects Ruby versions through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4.
💻 Affected Systems
- Ruby
- Ruby on Rails applications
- Applications using Ruby Shell methods
📦 What is this software?
Graalvm by Oracle
Leap by Opensuse
Ruby by Ruby Lang
Ruby by Ruby Lang
Ruby by Ruby Lang
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with arbitrary code execution leading to data theft, ransomware deployment, or complete system takeover.
Likely Case
Application compromise allowing data exfiltration, privilege escalation, or lateral movement within the environment.
If Mitigated
Limited impact with proper input validation and sandboxing, potentially preventing exploitation entirely.
🎯 Exploit Status
Exploitation requires the application to use vulnerable Shell methods with user-controlled input. Proof of concept available in HackerOne report.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Ruby 2.4.8, 2.5.7, 2.6.5 and later
Vendor Advisory: https://www.ruby-lang.org/en/news/2019/10/01/code-injection-shell-test-cve-2019-16255/
Restart Required: Yes
Instructions:
1. Update Ruby to patched version using package manager (apt/yum) or Ruby version manager (rbenv/RVM). 2. Restart all Ruby processes and applications. 3. Verify update with 'ruby -v'.
🔧 Temporary Workarounds
Input Validation and Sanitization
allValidate and sanitize all user input before passing to Shell methods. Use allowlists for expected values.
Avoid Shell Methods with Untrusted Data
allReplace Shell#[] and Shell#test calls with safer alternatives like system() with explicit arguments or Open3 methods.
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all data passed to Shell methods
- Use application firewalls (WAF) to block suspicious patterns in user input
- Isolate vulnerable applications in network segments with restricted access
🔍 How to Verify
Check if Vulnerable:
Check Ruby version with 'ruby -v'. If version is 2.4.0-2.4.7, 2.5.0-2.5.6, or 2.6.0-2.6.4, system is vulnerable if using Shell methods with untrusted input.Check Version:
ruby -vVerify Fix Applied:
Verify Ruby version is 2.4.8+, 2.5.7+, or 2.6.5+ with 'ruby -v'. Test application functionality that uses Shell methods.📡 Detection & Monitoring
Log Indicators:
- Unusual Ruby method calls in application logs
- Suspicious command execution patterns
- Errors from Shell class with unexpected input
Network Indicators:
- Unusual outbound connections from Ruby processes
- Data exfiltration patterns
SIEM Query:
source="application.log" AND ("Shell#\[\]" OR "Shell#test") AND (suspicious_input_patterns)🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html
- https://hackerone.com/reports/327512
- https://lists.debian.org/debian-lts-announce/2019/11/msg00025.html
- https://lists.debian.org/debian-lts-announce/2019/12/msg00009.html
- https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html
- https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html
- https://seclists.org/bugtraq/2019/Dec/31
- https://seclists.org/bugtraq/2019/Dec/32
- https://security.gentoo.org/glsa/202003-06
- https://www.debian.org/security/2019/dsa-4587
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.ruby-lang.org/ja/news/2019/10/01/code-injection-shell-test-cve-2019-16255/
- https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-4-8-released/
- https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-5-7-released/
- https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-6-5-released/
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html
- https://hackerone.com/reports/327512
- https://lists.debian.org/debian-lts-announce/2019/11/msg00025.html
- https://lists.debian.org/debian-lts-announce/2019/12/msg00009.html
- https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html
- https://lists.debian.org/debian-lts-announce/2023/04/msg00033.html
- https://seclists.org/bugtraq/2019/Dec/31
- https://seclists.org/bugtraq/2019/Dec/32
- https://security.gentoo.org/glsa/202003-06
- https://www.debian.org/security/2019/dsa-4587
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.ruby-lang.org/ja/news/2019/10/01/code-injection-shell-test-cve-2019-16255/
- https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-4-8-released/
- https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-5-7-released/
- https://www.ruby-lang.org/ja/news/2019/10/01/ruby-2-6-5-released/
