VYPR
← All advisories
High severityNVD Advisory· Published May 12, 2020· Updated Aug 4, 2024

CVE-2020-8151

CVE-2020-8151

Description

There is a possible information disclosure issue in Active Resource <v5.1.1 that could allow an attacker to create specially crafted requests to access data in an unexpected way and possibly leak information.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Active Resource < v5.1.1 uses insufficiently encoded ID parameters in URL paths, enabling specially crafted requests to leak information.

Vulnerability

Overview

CVE-2020-8151 is an information disclosure vulnerability in Active Resource prior to version 5.1.1. The root cause lies in the element_path method, which constructs URLs for REST resources using URI.parser.escape to encode ID parameter values [1][3]. This encoding routine does not properly handle certain characters, such as ? or ../, allowing an attacker to inject unexpected path components or query strings into the generated URL.

Exploitation and

Attack Surface

An attacker can exploit this by providing a crafted ID value to an Active Resource client—for example, by sending a request that includes a ? or ../ in the resource identifier. Because URI.parser.escape fails to encode these characters in a way that prevents URL structure manipulation, the generated request may be sent to an unintended endpoint on the remote API [3]. The fix introduced in commit 0de18f7 replaces the encoding method with URI.encode_www_form_component, which correctly encodes such characters [3]. No authentication is required to trigger this issue; any attacker who can influence the ID parameter used in a find or similar operation can attempt exploitation.

Impact

Successful exploitation could allow an attacker to access data or API resources outside the intended scope. For instance, by injecting ../ an attacker might cause the client to request a parent collection or another resource, potentially leaking information that was not meant to be exposed [3]. The vulnerability is rated as medium severity (CVSS v2 score 5.0) [2].

Mitigation

Status

Users should upgrade to Active Resource version 5.1.1 or later, which includes the corrected encoding logic [1][2][3]. There is no workaround other than applying the patch. No evidence of active exploitation in the wild or inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog was found in the provided references.

References
  1. GitHub - rails/activeresource: Connects business objects and REST web services
  2. NVD - CVE-2020-8151
  3. Properly encode ID parameters to avoid possible information leak · rails/activeresource@0de18f7

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
activeresourceRubyGems
>= 3.0.0.rc, < 5.1.15.1.1

Affected products

203

Patches

2
0de18f7e96fa

Properly encode ID parameters to avoid possible information leak

https://github.com/rails/activeresourceAaron PattersonMay 5, 2020via ghsa
commit
3 files changed · +18 −2
  • lib/active_resource/base.rb+1 −1 modified
    @@ -772,7 +772,7 @@ def element_path(id, prefix_options = {}, query_options = nil)
         check_prefix_options(prefix_options)
 
         prefix_options, query_options = split_options(prefix_options) if query_options.nil?
-        "#{prefix(prefix_options)}#{collection_name}/#{URI.parser.escape id.to_s}#{format_extension}#{query_string(query_options)}"
+        "#{prefix(prefix_options)}#{collection_name}/#{URI.encode_www_form_component(id.to_s)}#{format_extension}#{query_string(query_options)}"
       end
 
       # Gets the element url for the given ID in +id+. If the +query_options+ parameter is omitted, Rails
  • test/cases/base_test.rb+1 −1 modified
    @@ -688,7 +688,7 @@ def test_custom_element_path
     assert_equal "/people/1/addresses/1.json", StreetAddress.element_path(1, person_id: 1)
     assert_equal "/people/1/addresses/1.json", StreetAddress.element_path(1, "person_id" => 1)
     assert_equal "/people/Greg/addresses/1.json", StreetAddress.element_path(1, "person_id" => "Greg")
-    assert_equal "/people/ann%20mary/addresses/ann%20mary.json", StreetAddress.element_path(:'ann mary', "person_id" => "ann mary")
+    assert_equal "/people/ann%20mary/addresses/ann+mary.json", StreetAddress.element_path(:'ann mary', "person_id" => "ann mary")
   end
 
   def test_custom_element_path_without_required_prefix_param
  • test/cases/finder_test.rb+16 −0 modified
    @@ -172,4 +172,20 @@ def test_find_single_by_symbol_from
     david = Person.find(:one, from: :leader)
     assert_equal "David", david.name
   end
+
+  def test_find_identifier_encoding
+    ActiveResource::HttpMock.respond_to { |m| m.get "/people/%3F.json", {}, @david }
+
+    david = Person.find("?")
+
+    assert_equal "David", david.name
+  end
+
+  def test_find_identifier_encoding_for_path_traversal
+    ActiveResource::HttpMock.respond_to { |m| m.get "/people/..%2F.json", {}, @david }
+
+    david = Person.find("../")
+
+    assert_equal "David", david.name
+  end
 end
0e969bdaf8ff

fix escaping id and parameters in path [#5137 state:resolved]

https://github.com/rails/railsJosef ReidingerJul 22, 2010via ghsa
commit
2 files changed · +3 −2
  • activeresource/lib/active_resource/base.rb+2 −2 modified
    @@ -577,7 +577,7 @@ def prefix_source
       # Default value is <tt>site.path</tt>.
       def prefix=(value = '/')
         # Replace :placeholders with '#{embedded options[:lookups]}'
-        prefix_call = value.gsub(/:\w+/) { |key| "\#{options[#{key}]}" }
+        prefix_call = value.gsub(/:\w+/) { |key| "\#{URI.escape options[#{key}].to_s}" }
 
         # Clear prefix parameters in case they have been cached
         @prefix_parameters = nil
@@ -622,7 +622,7 @@ def prefix(options={}) "#{prefix_call}" end
       #
       def element_path(id, prefix_options = {}, query_options = nil)
         prefix_options, query_options = split_options(prefix_options) if query_options.nil?
-        "#{prefix(prefix_options)}#{collection_name}/#{id}.#{format.extension}#{query_string(query_options)}"
+        "#{prefix(prefix_options)}#{collection_name}/#{URI.escape id.to_s}.#{format.extension}#{query_string(query_options)}"
       end
 
       # Gets the new element path for REST resources.
  • activeresource/test/cases/base_test.rb+1 −0 modified
    @@ -563,6 +563,7 @@ def test_custom_element_path
     assert_equal '/people/1/addresses/1.xml', StreetAddress.element_path(1, :person_id => 1)
     assert_equal '/people/1/addresses/1.xml', StreetAddress.element_path(1, 'person_id' => 1)
     assert_equal '/people/Greg/addresses/1.xml', StreetAddress.element_path(1, 'person_id' => 'Greg')
+    assert_equal '/people/ann%20mary/addresses/ann%20mary.xml', StreetAddress.element_path(:'ann mary', 'person_id' => 'ann mary')
   end
 
   def test_module_element_path

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

8

News mentions

0

No linked articles in our index yet.