CVE-2020-8159
📋 TL;DR
CVE-2020-8159 is a path traversal vulnerability in the actionpack_page-caching gem that allows attackers to write arbitrary files to a web server. This can lead to remote code execution if attackers can write unescaped ERB content to views. Affected systems are those using actionpack_page-caching gem versions below 1.2.1.
💻 Affected Systems
- actionpack_page-caching gem
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
Arbitrary file write allowing defacement, data manipulation, or privilege escalation depending on file permissions.
If Mitigated
Limited impact with proper file permissions and input validation, potentially only file writes to restricted directories.
🎯 Exploit Status
Exploitation requires the ability to write unescaped ERB content, which may depend on application configuration.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.1
Vendor Advisory: https://groups.google.com/forum/#!topic/rubyonrails-security/CFRVkEytdP8
Restart Required: Yes
Instructions:
1. Update Gemfile to specify 'gem "actionpack_page-caching", ">= 1.2.1"'. 2. Run 'bundle update actionpack_page-caching'. 3. Restart the application server.
🔧 Temporary Workarounds
Disable page caching
allTemporarily disable the page caching feature until patching is possible
Remove or comment out page caching configuration in your Rails application
🧯 If You Can't Patch
- Implement strict file permission controls on web server directories
- Deploy web application firewall rules to block path traversal attempts
🔍 How to Verify
Check if Vulnerable:
Check Gemfile.lock for actionpack_page-caching version: grep 'actionpack_page-caching' Gemfile.lockCheck Version:
bundle show actionpack_page-caching | grep -o '[0-9]\+\.[0-9]\+\.[0-9]\+'Verify Fix Applied:
Verify version is 1.2.1 or higher: bundle show actionpack_page-caching📡 Detection & Monitoring
Log Indicators:
- Unusual file write attempts in web server logs
- Path traversal patterns in request logs
Network Indicators:
- HTTP requests with directory traversal sequences in parameters
SIEM Query:
web_server_logs WHERE request_uri CONTAINS '../' OR request_uri CONTAINS '..%2F'