ASA-2019-00131 – Ruby on Rails: Denial of Service Vulnerability in Action View

Posted on by Allele Security Intelligence in Alerts

Allele Security Alert

ASA-2019-00131

Identifier(s)

ASA-2019-00131, CVE-2019-5419

Title

Denial of Service Vulnerability in Action View

Vendor(s)

Ruby on Rails core team

Product(s)

Ruby on Rails

Affected version(s)

All supported versions of Ruby on Rails

Fixed version(s)

Ruby on Rails 6.0.0.beta3
Ruby on Rails 5.2.2.1
Ruby on Rails 5.1.6.2
Ruby on Rails 5.0.7.2
Ruby on Rails 4.2.11.1

Proof of concept

Unknown

Description

Specially crafted accept headers can cause the Action View template location code to consume 100% CPU, causing the server unable to process requests. This impacts all Rails applications that render views.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Technical details

This vulnerability can be mitigated by wrapping `render` calls with `respond_to` blocks. For example, the following example is vulnerable:

```
class UserController < ApplicationController
  def index
    render "index"
  end
end
```

But the following code is not vulnerable:

```
class UserController < ApplicationController
  def index
    respond_to |format|
      format.html { render "index" }
    end
  end
end
```

Implicit rendering is impacted, so this code is vulnerable:

```
class UserController < ApplicationController
  def index
  end
end
```

But can be changed to this:

```
class UserController < ApplicationController
  def index
    respond_to |format|
      format.html { render "index" }
    end
  end
end
```

Alternatively to specifying the format, the following monkey patch can be applied in an initializer:

```
$ cat config/initializers/formats_filter.rb
# frozen_string_literal: true

ActionDispatch::Request.prepend(Module.new do
  def formats
    super().select do |format|
      format.symbol || format.ref == "*/*"
    end
  end
end)
```

Credits

John Hawthorn (GitHub)

Reference(s)

Rails 4.2.11.1, 5.0.7.2, 5.1.6.2, 5.2.2.1, and 6.0.0.beta3 have been released!
https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/

[CVE-2019-5419] Denial of Service Vulnerability in Action View
https://groups.google.com/forum/#!topic/rubyonrails-security/GN7w9fFAQeI

[CVE-2019-5419] Denial of Service Vulnerability in Action View
https://seclists.org/oss-sec/2019/q1/177

Only accept formats from registered mime types
https://github.com/rails/rails/commit/f4c70c2222180b8d9d924f00af0c7fd632e26715

CVE-2019-5419
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5419

CVE-2019-5419
https://nvd.nist.gov/vuln/detail/CVE-2019-5419

If there is any error in this alert or you wish a comprehensive analysis, let us know.

Last modified: March 17, 2019

We are not responsible for any data loss, device corruption or any other type of issue due to the use of any information mentioned in our security alerts.