CVE-2020-8163

EPSS 83.1%CWE-94

Vexday Risk Score

45Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS —EPSS 83.1%KEV nãoPoC públicaPatch —

Lifecycle

19 Jun 2020Public PoC

02 Jul 2020Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call to perform a RCE.

Affected products

n/a · https://github.com/rails/rails

public PoCs found — 5

githubgithub.com/lucasamorimca/CVE-2020-8163★ 61 githubgithub.com/h4ms1k/CVE-2020-8163★ 4 githubgithub.com/RedBinaryRabbit/CVE-2020-8163★ 1 cve_referencepacketstormsecurity.com/files/158604/Ruby-On-Rails-5.0.1-Remote-Code-Execution.htmlunverified exploitdbwww.exploit-db.com/exploits/48716unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://packetstormsecurity.com/files/158604/Ruby-On-Rails-5.0.1-Remote-Code-Execution.html https://groups.google.com/g/rubyonrails-security/c/hWuKcHyoKh0 https://hackerone.com/reports/304805 https://lists.debian.org/debian-lts-announce/2020/07/msg00013.html