CVE-2022-32224: Ruby on Rails Active Record RCE via YAML Deserialization in Serialized Columns

CVE-2022-32224 · Severity: critical · CVSS 9.8 · Published 2022-12-05

A vulnerability in the Active Record component of Ruby on Rails could allow an attacker to execute malicious code on a server. This occurs when the application processes data stored in the database that has been tampered with, typically through a secondary attack like SQL injection. If exploited, this could lead to a full system takeover, data theft, or complete service disruption.

Technologies: Ruby on Rails Rails, activerecord (RubyGems). Vendors: Ruby on Rails, RubyGems.

Quick answers

Is CVE-2022-32224 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2022-32224 being exploited in the wild.
How severe is CVE-2022-32224?
Critical severity, with a CVSS score of 9.8, published 5 December 2022.
Which products and versions are affected?
Ruby on Rails Active Record < 5.2.8.1, >= 6.0.0, < 6.0.5.1, >= 6.1.0, < 6.1.6.1, >= 7.0.0, < 7.0.3.1; Ruby on Rails Rails <= 5.2.8, >= 6.0.0, <= 6.0.5, >= 6.1.0, <= 6.1.6, >= 7.0.0, <= 7.0.3; activerecord (RubyGems) ECOSYSTEM:introduced=7.0.0,fixed=7.0.3.1.
Is there a fix for CVE-2022-32224?
Yes. activerecord (RubyGems): upgrade to 7.0.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-32224 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2022-32224?
Check whether you run Ruby on Rails Active Record, Ruby on Rails Rails or activerecord (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • activerecord (RubyGems): upgrade to 7.0.3.1 or later
    bundle update activerecord

Technical details

Active Record's YAML serialization coder used 'YAML.unsafe_load' (Psych) by default when retrieving data from serialized columns. This allows for the instantiation of arbitrary Ruby objects, which can be leveraged for remote code execution (CWE-502). An attacker must first be able to manipulate data within the database, for example via a separate SQL injection vulnerability. The fix changes the default deserializer to 'YAML.safe_load' and introduces configuration options ('use_yaml_unsafe_load' and 'yaml_column_permitted_classes') to manage backward compatibility. Patches are available for Rails versions 5.2.x, 6.0.x, 6.1.x, and 7.0.x.

Affected products

  • Ruby on Rails (Rails) activerecord <= 5.2.8, >= 6.0.0, <= 6.0.5, >= 6.1.0, <= 6.1.6, >= 7.0.0, <= 7.0.3

Identifiers

  • CVE-2022-32224
  • GHSA-3hhc-qp5v-9p2j

Timeline

  • 2022-07-12: disclosed
  • 2022-07-12: patched
  • 2022-07-12: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.