Vulnerability advisory

GHSA-cr3x-7m39-c6jq

Remote code execution via user-provided local names in ActionView

Published Jul 7, 2020Updated Feb 16, 2024OSV record ↗

Also known as BIT-rails-2020-8163CVE-2020-8163

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected versions

actionview RubyGems

All actionview advisories →

Affected Fixed in

All versions before 4.2.11.3 4.2.11.3Advisories →

Affected	Fixed in
All versions before 4.2.11.3	`4.2.11.3`Advisories →
Also listed as affected (78) `4.1.0` `4.1.0.beta1` `4.1.0.beta2` `4.1.0.rc1` `4.1.0.rc2` `4.1.1` `4.1.10` `4.1.10.rc1` `4.1.10.rc2` `4.1.10.rc3` `4.1.10.rc4` `4.1.11` `4.1.12` `4.1.12.rc1` `4.1.13` `4.1.13.rc1` `4.1.14` `4.1.14.1` `4.1.14.2` `4.1.14.rc1` `4.1.14.rc2` `4.1.15` `4.1.15.rc1` `4.1.16` `4.1.16.rc1` `4.1.2` `4.1.2.rc1` `4.1.2.rc2` `4.1.2.rc3` `4.1.3` `4.1.4` `4.1.5` `4.1.6` `4.1.6.rc1` `4.1.6.rc2` `4.1.7` `4.1.7.1` `4.1.8` `4.1.9` `4.1.9.rc1` `4.2.0` `4.2.0.beta1` `4.2.0.beta2` `4.2.0.beta3` `4.2.0.beta4` `4.2.0.rc1` `4.2.0.rc2` `4.2.0.rc3` `4.2.1` `4.2.1.rc1` `4.2.1.rc2` `4.2.1.rc3` `4.2.1.rc4` `4.2.10` `4.2.10.rc1` `4.2.11` `4.2.11.1` `4.2.11.2` `4.2.2` `4.2.3` `4.2.3.rc1` `4.2.4` `4.2.4.rc1` `4.2.5` `4.2.5.1` `4.2.5.2` `4.2.5.rc1` `4.2.5.rc2` `4.2.6` `4.2.6.rc1` `4.2.7` `4.2.7.1` `4.2.7.rc1` `4.2.8` `4.2.8.rc1` `4.2.9` `4.2.9.rc1` `4.2.9.rc2`

Also listed as affected (78)

Description

The is a code injection vulnerability in versions of Rails prior to 5.0.1 that would allow an attacker who controlled the locals argument of a render call to perform a RCE.

References

Advisorynvd.nist.gov/vuln/detail/CVE-2020-8163 ↗
Webhackerone.com/reports/304805 ↗
Webgithub.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2020-8163.yml ↗
Webgroups.google.com/forum/#!topic/rubyonrails-security/hWuKcHyoKh0 ↗
Webgroups.google.com/g/rubyonrails-security/c/hWuKcHyoKh0 ↗
Weblists.debian.org/debian-lts-announce/2020/07/msg00013.html ↗
Webpacketstormsecurity.com/files/158604/Ruby-On-Rails-5.0.1-Remote-Code-Execution.html ↗