CVE-2020-8163
📋 TL;DR
This is a remote code execution vulnerability in Ruby on Rails that allows attackers to execute arbitrary code on vulnerable systems. It affects applications using Rails versions before 5.0.1 where user input can reach the 'locals' parameter in render calls.
💻 Affected Systems
- Ruby on Rails
📦 What is this software?
Rails by Rubyonrails
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attacker to execute arbitrary commands, access sensitive data, and pivot to other systems.
Likely Case
Application compromise leading to data theft, defacement, or lateral movement within the network.
If Mitigated
Limited impact if proper input validation and sandboxing are in place, but still potentially serious.
🎯 Exploit Status
Multiple public exploit PoCs available, including on Packet Storm and HackerOne.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.0.1 or later
Vendor Advisory: https://groups.google.com/g/rubyonrails-security/c/hWuKcHyoKh0
Restart Required: Yes
Instructions:
1. Update Gemfile to specify 'gem "rails", ">= 5.0.1"' 2. Run 'bundle update rails' 3. Restart application server
🔧 Temporary Workarounds
Input validation for render locals
allValidate and sanitize all user input before passing to render calls
🧯 If You Can't Patch
- Implement strict input validation for all parameters passed to render calls
- Use WAF rules to block suspicious render parameter patterns
🔍 How to Verify
Check if Vulnerable:
Check Rails version with 'rails --version' or examine Gemfile.lock for rails versionCheck Version:
rails --versionVerify Fix Applied:
Confirm Rails version is 5.0.1 or higher and test render functionality with controlled inputs📡 Detection & Monitoring
Log Indicators:
- Unusual render calls with complex locals parameters
- Errors from render calls with unexpected input
Network Indicators:
- HTTP requests with suspicious parameter names containing render locals
SIEM Query:
source="rails.log" AND ("render" AND "locals" AND ("eval" OR "system" OR "exec"))🔗 References
- http://packetstormsecurity.com/files/158604/Ruby-On-Rails-5.0.1-Remote-Code-Execution.html
- https://groups.google.com/g/rubyonrails-security/c/hWuKcHyoKh0
- https://hackerone.com/reports/304805
- https://lists.debian.org/debian-lts-announce/2020/07/msg00013.html
- http://packetstormsecurity.com/files/158604/Ruby-On-Rails-5.0.1-Remote-Code-Execution.html
- https://groups.google.com/g/rubyonrails-security/c/hWuKcHyoKh0
- https://hackerone.com/reports/304805
- https://lists.debian.org/debian-lts-announce/2020/07/msg00013.html
