SERVER-WEBAPP -- Snort has detected traffic exploiting vulnerabilities in web based applications on servers.
SERVER-WEBAPP Ruby on Rails Active Storage deserialization remote code execution attempt
This event is generated when there is a Ruby on Rails Active Storage deserialization remote code execution attempt. Impact: CVSS v3.0 Severity and Metrics: CVSS base score 9.8 CVSS impact score 5.9 CVSS exploitability score: 3.9 Confidentiality (C): High Integrity (I): High Availability (A): High Details: Ease of Attack: Simple
No public information
No known false positives
Cisco Talos Intelligence Group
Tactic:
Technique:
For reference, see the MITRE ATT&CK vulnerability types here: https://attack.mitre.org
CVE-2019-5420A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalate to a remote code execution exploit. |
|
|||||||||||||||||||||||||||||||
©2023 Cisco and/or its affiliates. Snort, the Snort and Pig logo are registered trademarks of Cisco. All rights reserved.
