Improper input validation in Rubyonrails Rails
CVE-2016-2098
Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.867 (99.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.3 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.
Affected products
- Rubyonrails Rails — versions 4.0.0, 4.0.1, 4.0.2
- Rubyonrails Ruby_on_rails — versions 4.1.14.1
- Debian Debian_linux — versions 8.0
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
- 0x00-0x00/CVE-2016-2098
- j4k0m/CVE-2016-2098
- hderms/dh-CVE_2016_2098
- Shakun8/CVE-2016-2098
- DanielHemmati/CVE-2016-2098-my-first-exploit
- its-arun/CVE-2016-2098
- Alejandro-MartinG/rails-PoC-CVE-2016-2098
- CyberDefenseInstitute/PoC_CVE-2016-2098_Rails42
- sealldeveloper/CVE-2016-2098-PoC
- JoseLRC97/Ruby-on-Rails-ActionPack-Inline-ERB-Remote-Code-Execution
References
- SUSE-SU-2016:0867 (vendor-advisory, x_refsource_SUSE)
- SUSE-SU-2016:0967 (vendor-advisory, x_refsource_SUSE)
- DSA-3509 (vendor-advisory, x_refsource_DEBIAN)
- 83725 (vdb-entry, x_refsource_BID)
- 1035122 (vdb-entry, x_refsource_SECTRACK)
- 40086 (exploit, x_refsource_EXPLOIT-DB)
- SUSE-SU-2016:0854 (vendor-advisory, x_refsource_SUSE)
- openSUSE-SU-2016:0790 (vendor-advisory, x_refsource_SUSE)
- SUSE-SU-2016:1146 (vendor-advisory, x_refsource_SUSE)
- openSUSE-SU-2016:0835 (vendor-advisory, x_refsource_SUSE)
Frequently asked questions
- What is CVE-2016-2098?
- CVE-2016-2098 is a high-severity vulnerability in Rubyonrails Rails, classified under Improper Input Validation. CVSS score: 7.3/10. Published 2016-04-07.
- How severe is CVE-2016-2098?
- High severity. CVSS v3 base score is 7.3 out of 10.
- Is CVE-2016-2098 known to be exploited?
- 20 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.