{"schema_version":"1.7.3","id":"GHSA-2p68-f74v-9wc6","published":"2020-05-26T14:49:24Z","modified":"2025-05-09T22:03:05.053764Z","aliases":["CVE-2020-8165"],"summary":"ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore","details":"In ActiveSupport, there is potentially unexpected behaviour in the MemCacheStore and RedisCacheStore where, when\nuntrusted user input is written to the cache store using the `raw: true` parameter, re-reading the result\nfrom the cache can evaluate the user input as a Marshalled object instead of plain text. Vulnerable code looks like:\n\n```\ndata = cache.fetch(\"demo\", raw: true) { untrusted_string }\n```\nVersions Affected:  rails < 5.2.5, rails < 6.0.4\nNot affected:       Applications not using MemCacheStore or RedisCacheStore. Applications that do not use the `raw` option when storing untrusted user input.\nFixed Versions:     rails >= 5.2.4.3, rails >= 6.0.3.1\n  \nImpact\n------\nUnmarshalling of untrusted user input can have impact up to and including RCE. At a minimum,\nthis vulnerability allows an attacker to inject untrusted Ruby objects into a web application.\nIn addition to upgrading to the latest versions of Rails, developers should ensure that whenever\nthey are calling `Rails.cache.fetch` they are using consistent values of the `raw` parameter for both\nreading and writing, especially in the case of the RedisCacheStore which does not, prior to these changes,\ndetect if data was serialized using the raw option upon deserialization.\n\nWorkarounds\n-----------\nIt is recommended that application developers apply the suggested patch or upgrade to the latest release as\nsoon as possible. If this is not possible, we recommend ensuring that all user-provided strings cached using\nthe `raw` argument should be double-checked to ensure that they conform to the expected format.","affected":[{"package":{"name":"activesupport","ecosystem":"RubyGems","purl":"pkg:gem/activesupport"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.2.4.3"}]}],"versions":["5.0.0","5.0.0.1","5.0.1","5.0.1.rc1","5.0.1.rc2","5.0.2","5.0.2.rc1","5.0.3","5.0.4","5.0.4.rc1","5.0.5","5.0.5.rc1","5.0.5.rc2","5.0.6","5.0.6.rc1","5.0.7","5.0.7.1","5.0.7.2","5.1.0","5.1.0.beta1","5.1.0.rc1","5.1.0.rc2","5.1.1","5.1.2","5.1.2.rc1","5.1.3","5.1.3.rc1","5.1.3.rc2","5.1.3.rc3","5.1.4","5.1.4.rc1","5.1.5","5.1.5.rc1","5.1.6","5.1.6.1","5.1.6.2","5.1.7","5.1.7.rc1","5.2.0","5.2.0.beta1","5.2.0.beta2","5.2.0.rc1","5.2.0.rc2","5.2.1","5.2.1.1","5.2.1.rc1","5.2.2","5.2.2.1","5.2.2.rc1","5.2.3","5.2.3.rc1","5.2.4","5.2.4.1","5.2.4.2","5.2.4.rc1"],"database_specific":{"last_known_affected_version_range":"<= 5.2.4.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/05/GHSA-2p68-f74v-9wc6/GHSA-2p68-f74v-9wc6.json"}},{"package":{"name":"activesupport","ecosystem":"RubyGems","purl":"pkg:gem/activesupport"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3.1"}]}],"versions":["6.0.0","6.0.1","6.0.1.rc1","6.0.2","6.0.2.1","6.0.2.2","6.0.2.rc1","6.0.2.rc2","6.0.3","6.0.3.rc1"],"database_specific":{"last_known_affected_version_range":"<= 6.0.3","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/05/GHSA-2p68-f74v-9wc6/GHSA-2p68-f74v-9wc6.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8165"},{"type":"WEB","url":"https://hackerone.com/reports/413388"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2020-8165.yml"},{"type":"WEB","url":"https://groups.google.com/forum/#!topic/rubyonrails-security/bv6fW4S0Y1c"},{"type":"WEB","url":"https://groups.google.com/g/rubyonrails-security/c/bv6fW4S0Y1c"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2020/06/msg00022.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2020/07/msg00013.html"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20250509-0002"},{"type":"WEB","url":"https://weblog.rubyonrails.org/2020/5/18/Rails-5-2-4-3-and-6-0-3-1-have-been-released"},{"type":"WEB","url":"https://www.debian.org/security/2020/dsa-4766"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00031.html"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00034.html"}],"database_specific":{"cwe_ids":["CWE-502"],"github_reviewed":true,"github_reviewed_at":"2020-05-26T14:47:03Z","nvd_published_at":"2020-06-19T18:15:00Z","severity":"CRITICAL"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}