CVE-2020-8163

CVE-2020-8163 describes a code injection vulnerability in Ruby on Rails versions prior to 5.0.1. The root cause is that the framework did not properly validate or restrict the names of local variables passed via the locals argument in the render method [1][3]. This allows an attacker who can control the names of these local variables to inject arbitrary Ruby code, leading to remote code execution (RCE).

Exploitation

To exploit this vulnerability, an attacker must be able to control the locals hash passed to a render call, specifically the keys (variable names) within that hash [1]. This is typically possible if user-supplied input is directly passed to the render method as part of the locals parameter. The attacker does not need authentication if the vulnerable endpoint is accessible without credentials [3].

Impact

Successful exploitation grants the attacker the ability to execute arbitrary Ruby code on the server, potentially leading to full compromise of the application, data theft, or further lateral movement [1].

Mitigation

The vulnerability is fixed in Rails 4.2.11.3 and 5.0.1 [2][3]. Users of earlier versions should upgrade as soon as possible. For those unable to upgrade, a patch is available, and a workaround is to ensure all user-provided local names are alphanumeric [3].