CVE-2020-8162

Vulnerability

Overview

CVE-2020-8162 is a client-side enforcement of server-side security vulnerability in Ruby on Rails ActiveStorage's S3 adapter, affecting versions before 5.2.4.2 and 6.0.3.1 [2][4]. The root cause is that the server does not independently verify the Content-Length value of a direct file upload URL, relying instead on client-provided data [1]. This allows an attacker to craft a direct upload request with a manipulated Content-Length, effectively bypassing server-enforced file size limits.

Attack

Vector

The vulnerability is exploitable by any end user who can access the ActiveStorage direct upload functionality for an S3 adapter [4]. No special network position or authentication is required beyond normal application access [1]. By intercepting or modifying the direct upload URL's Content-Length parameter, an attacker can trick the server into accepting files larger than the intended limit. The attacker does not need a new signature from the server to alter this value [4].

Impact

Successful exploitation allows an attacker to upload files of arbitrary size, bypassing upload size controls enforced by the Rails application [2][4]. This could lead to storage exhaustion, denial of service, or the uploading of malicious payloads that exceed expected constraints. The impact is considered low severity by the Rails security team, but it can still enable further attacks if combined with other application weaknesses [4].

Mitigation

Patches are available in Rails versions 5.2.4.3 and 6.0.3.1, which include server-side validation of the Content-Length for S3 direct uploads [4]. Applications that do not use ActiveStorage's direct upload feature with the S3 adapter are not affected [4]. No workaround is recommended beyond upgrading, as this is a low-severity issue [4]. The CVE is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.