NVD Vulnerability Detail

CVE-2019-5420

Summary	A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalate to a remote code execution exploit.
Publication Date	March 27, 2019, 11:29 p.m.
Registration Date	Jan. 26, 2021, 11:43 a.m.
Last Update	Nov. 21, 2024, 1:44 p.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://packetstormsecurity.com/files/152704/Ruby-On-Rails-DoubleTap-Development-Mode-secret_key_base-Remote-Code-Execution.html	Exploit Third Party Advisory VDB Entry
2	http://packetstormsecurity.com/files/152704/Ruby-On-Rails-DoubleTap-Development-Mode-secret_key_base-Remote-Code-Execution.html	Exploit Third Party Advisory VDB Entry
3	https://groups.google.com/forum/#%21topic/rubyonrails-security/IsQKvDqZdKw
4	https://groups.google.com/forum/#%21topic/rubyonrails-security/IsQKvDqZdKw
5	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA/
6	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA/
7	https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/	Patch Vendor Advisory
8	https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/	Patch Vendor Advisory
9	https://www.exploit-db.com/exploits/46785/	Exploit Third Party Advisory VDB Entry
10	https://www.exploit-db.com/exploits/46785/	Exploit Third Party Advisory VDB Entry

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-330	不十分なランダム値の使用	https://cwe.mitre.org/data/definitions/330.html

JVN Vulnerability Information

Rails における入力確認に関する脆弱性

Title	Rails における入力確認に関する脆弱性
Summary	Rails には、入力確認に関する脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	March 13, 2019, midnight
Registration Date	May 8, 2019, 4:11 p.m.
Last Update	May 8, 2019, 4:11 p.m.

Affected System

Debian

Debian GNU/Linux

Ruby on Rails project

RailsXss plugin 5.2.2.1 未満

RailsXss plugin 6.0.0.beta3 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2019-5420	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5420
National Vulnerability Database (NVD)
2	CVE-2019-5420	https://nvd.nist.gov/vuln/detail/CVE-2019-5420

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	Name	URL
Debian
1	Top Page	https://www.debian.org/
Google Groups
2	[CVE-2019-5420] Possible Remote Code Execution Exploit in Rails Development Mode	https://groups.google.com/forum/#!topic/rubyonrails-security/IsQKvDqZdKw
Rails weblog
3	Rails 4.2.11.1, 5.0.7.2, 5.1.6.2, 5.2.2.1, and 6.0.0.beta3 have been released!	https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/

Change Log

No	Changed Details	Date of change
1	[2019年05月08日] 掲載	May 8, 2019, 4:11 p.m.