CVE-2020-8165: Activesupport ActiveSupport Potentially Unintended Unmarshalling Of Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-2p68-f74v-9wc6",
  "modified" : "2025-05-09T21:34:13Z",
  "published" : "2020-05-26T14:49:24Z",
  "aliases" : [ "CVE-2020-8165" ],
  "summary" : "ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore",
  "details" : "In ActiveSupport, there is potentially unexpected behaviour in the MemCacheStore and RedisCacheStore where, when\nuntrusted user input is written to the cache store using the `raw: true` parameter, re-reading the result\nfrom the cache can evaluate the user input as a Marshalled object instead of plain text. Vulnerable code looks like:\n\n```\ndata = cache.fetch(\"demo\", raw: true) { untrusted_string }\n```\nVersions Affected:  rails < 5.2.5, rails < 6.0.4\nNot affected:       Applications not using MemCacheStore or RedisCacheStore. Applications that do not use the `raw` option when storing untrusted user input.\nFixed Versions:     rails >= 5.2.4.3, rails >= 6.0.3.1\n  \nImpact\n------\nUnmarshalling of untrusted user input can have impact up to and including RCE. At a minimum,\nthis vulnerability allows an attacker to inject untrusted Ruby objects into a web application.\nIn addition to upgrading to the latest versions of Rails, developers should ensure that whenever\nthey are calling `Rails.cache.fetch` they are using consistent values of the `raw` parameter for both\nreading and writing, especially in the case of the RedisCacheStore which does not, prior to these changes,\ndetect if data was serialized using the raw option upon deserialization.\n\nWorkarounds\n-----------\nIt is recommended that application developers apply the suggested patch or upgrade to the latest release as\nsoon as possible. If this is not possible, we recommend ensuring that all user-provided strings cached using\nthe `raw` argument should be double-checked to ensure that they conform to the expected format.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "RubyGems",
      "name" : "activesupport"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "5.0.0"
      }, {
        "fixed" : "5.2.4.3"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 5.2.4.2"
    }
  }, {
    "package" : {
      "ecosystem" : "RubyGems",
      "name" : "activesupport"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "6.0.0"
      }, {
        "fixed" : "6.0.3.1"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 6.0.3"
    }
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2020-8165"
  }, {
    "type" : "WEB",
    "url" : "https://hackerone.com/reports/413388"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2020-8165.yml"
  }, {
    "type" : "WEB",
    "url" : "https://groups.google.com/forum/#!topic/rubyonrails-security/bv6fW4S0Y1c"
  }, {
    "type" : "WEB",
    "url" : "https://groups.google.com/g/rubyonrails-security/c/bv6fW4S0Y1c"
  }, {
    "type" : "WEB",
    "url" : "https://lists.debian.org/debian-lts-announce/2020/06/msg00022.html"
  }, {
    "type" : "WEB",
    "url" : "https://lists.debian.org/debian-lts-announce/2020/07/msg00013.html"
  }, {
    "type" : "WEB",
    "url" : "https://security.netapp.com/advisory/ntap-20250509-0002"
  }, {
    "type" : "WEB",
    "url" : "https://weblog.rubyonrails.org/2020/5/18/Rails-5-2-4-3-and-6-0-3-1-have-been-released"
  }, {
    "type" : "WEB",
    "url" : "https://www.debian.org/security/2020/dsa-4766"
  }, {
    "type" : "WEB",
    "url" : "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00031.html"
  }, {
    "type" : "WEB",
    "url" : "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00034.html"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-502" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2020-05-26T14:47:03Z",
    "nvd_published_at" : "2020-06-19T18:15:00Z"
  }
}