Ruby on Rails up to 4.2.11.0/5.0.7.1/5.1.6.1/5.2.2.0 Action View Header resource consumption

Summaryinfo

A vulnerability classified as problematic was found in Ruby on Rails up to 4.2.11.0/5.0.7.1/5.1.6.1/5.2.2.0. This affects an unknown part of the component Action View. The manipulation as part of Header results in resource consumption. This vulnerability is reported as CVE-2019-5419. The attack can be launched remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic has been found in Ruby on Rails up to 4.2.11.0/5.0.7.1/5.1.6.1/5.2.2.0 (Programming Language Software). Affected is an unknown function of the component Action View. The manipulation as part of a Header leads to a resource consumption vulnerability. CWE is classifying the issue as CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. This is going to have an impact on availability. CVE summarizes:

There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted accept headers can cause action view to consume 100% cpu and make the server unresponsive.

The bug was discovered 03/13/2019. The weakness was disclosed 03/27/2019 (oss-sec). The advisory is shared for download at openwall.com. This vulnerability is traded as CVE-2019-5419 since 01/04/2019. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1499.

The vulnerability was handled as a non-public zero-day exploit for at least 14 days. During that time the estimated underground price was around $0-$5k. The vulnerability scanner Nessus provides a plugin with the ID 210457 (RHEL 6 / 7 : rh-ror42-rubygem-actionpack (RHSA-2019:1149)), which helps to determine the existence of the flaw in a target environment. The commercial vulnerability scanner Qualys is able to test this issue with plugin 13442 (Ruby on Rails Multiple Security Vulnerabilities).

Upgrading to version 4.2.11.1, 5.0.7.2, 5.1.6.2 or 5.2.2.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (210457). The entries VDB-132551 and VDB-132553 are pretty similar. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Programming Language Software

Name

• Ruby on Rails

Version

• 4.2.0
• 4.2.1
• 4.2.2
• 4.2.3
• 4.2.4
• 4.2.5
• 4.2.6
• 4.2.7
• 4.2.8
• 4.2.9
• 4.2.10
• 4.2.11.0
• 5.0.7.0
• 5.0.7.1
• 5.1.6.0
• 5.1.6.1
• 5.2.0
• 5.2.1
• 5.2.2.0

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion