Remote Code Execution Vulnerability in Rails by Ruby on Rails
CVE-2019-5420

9.8CRITICAL

Key Information:

Vendor: Rails
Status: Https://github.com/rails/rails
Vendor: CVE Published:; 27 March 2019

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 93%

Summary

A vulnerability exists in Ruby on Rails that allows an attacker to exploit the development mode environment. Specifically, if the application runs on versions below 5.2.2.1 or 6.0.0.beta3, the system's automatically generated development mode secret token can be guessed. This token, when combined with specific Rails internals, can potentially lead to a remote code execution attack, enabling unauthorized command execution on the affected server.

Affected Version(s)

https://github.com/rails/rails 5.2.2.1

https://github.com/rails/rails 6.0.0.beta3

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2019-5420
Created by knqyf263

CVE-2019-5420
Created by j4k0m

ruby-RCE-CVE-2019-5420-
Created by laffray