The flaw lies in Action Pack, the component of Ruby on Rails, in versions before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2. An attacker with remote access can execute arbitrary Ruby code by abusing an application's unrestricted use of the render method, which requires that the affected application pass untrusted input into render.
Public exploit code (PoC-in-GitHub) was available 37 days before disclosure.
8 fixes in actionpack over 4 years. The latest fix listed for actionpack is 6.0.3.2.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: actionpack.
Upgrade to 4.2.5.2 or later
Fixes this CVE and 1 other known vulnerability in this package (CVE-2016-0752).
gem "actionpack", ">= 4.2.5.2"The first fix for CVE-2016-2098.
| If you run | Upgrade to |
|---|---|
| 4.2.0 up to 4.2.5.2 | 4.2.5.2 |
| 4.0.0 up to 4.1.14.2 | 4.1.14.2 |
| 3.0.0 up to 3.2.22.2 | 3.2.22.2 |
“Up to” means the second version is the fix and is not affected.