Rails · https://github.com/rails/rails
A remote code execution flaw in the development mode of Rails (versions before 5.2.2.1 and 6.0.0.beta3) lets an attacker guess the automatically generated development secret token, a weakness classed as command injection. The attacker needs only to reach a Rails application running in development mode, and the guessed token can then be combined with other Rails internals to achieve remote code execution.
A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalate to a remote code execution exploit.
Public exploit code (Metasploit) was available 14 days before disclosure.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: railties.
Upgrade to 5.2.2.1 or later
gem "railties", ">= 5.2.2.1"The first fix for CVE-2019-5420. No other CVE tracked by Patchfirst affects this package.
| If you run | Upgrade to |
|---|---|
| 5.2.0 up to 5.2.2.1 | 5.2.2.1 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.