Today’s rails security update in plain english
Tags: rails, security, ruby
Published: 2019-03-14 02:31:33

---
title: Today’s rails security update in plain english
published: true
description: The rails team pushed three security fixes.
tags: rails, security, ruby
canonical_url: https://blog.sharesecret.co/todays-rails-security-update-plain-english/
cover_image: https://thepracticaldev.s3.amazonaws.com/i/aa6ol4gcyy81zdfu58dg.png
---

*Cross-posted from [the ShareSecret blog](https://blog.sharesecret.co/todays-rails-security-update-plain-english/).*

* * *

Earlier today the Rails team [pushed new versions](https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/) to patch three security vulnerabilities:

1. [CVE-2019-5418](https://groups.google.com/forum/#!topic/rubyonrails-security/pFRKI96Sm8Q): Action view file content disclosure
2. [CVE-2019-5419](https://groups.google.com/forum/#!topic/rubyonrails-security/GN7w9fFAQela): Action view Denial of Service (DOS)
3. [CVE-2019-5420](https://groups.google.com/forum/#!topic/rubyonrails-security/IsQKvDqZdKw): Rails development mode Remote code execution (RCE)

I’ve addressed the vulnerabilities below in order of severity.

**Note: The [rails upgrade guide](https://guides.rubyonrails.org/upgrading_ruby_on_rails.html) is a great resource for upgrading your rails app.**

## 🚨 🚨 🚨 🚨 🚨 🔥 Action View Denial of Service (DOS)
**Alarm level:** Five alarm fire. Patch immediately.

If you’re rendering tempates, you’re almost definitely subject to a DOS attack. This one is really bad. Patch/upgrade immediately.

Using specially crafted headers you can max out the CPU by exploiting the template location code. Rendering templates wrapped in a `respond_to` block is safe. Otherwise, you’re vulnerable.

Vulnerable:
```ruby
class UserController < ApplicationController 
  def index 
    render "index" 
  end 
end 
```

Not vulnerable: 
```ruby
class UserController < ApplicationController 
  def index 
    respond_to |format| 
      format.html { render "index" } 
    end 
  end 
end 
```

[Read more](https://groups.google.com/forum/#!topic/rubyonrails-security/GN7w9fFAQeI)

## 🚨 🚨 🚨 🚨 🚨 🔥 Action View File Content Disclosure
**Alarm level:** Five alarm fire. Patch immediately.

By using specially crafted headers, you can view an arbitrary file’s content with if you use `render file: 'filename'`. Not good.

The good news: if you’re just rendering normal templates, you’re not affected *by this vulnerability*, though you’re probably affected by the CVE-2019-5419.

[Read more](https://groups.google.com/forum/#!topic/rubyonrails-security/pFRKI96Sm8Q)

## 🚨 Rails development mode RCE
**Alarm level:** Not good, but go back to sleep. Fix it in the morning. 

Due to how rails generates the `secret_key_base` **in development mode** — an MD5 of the app module name — if you know the name of the application, you can figure out the secret key. As long as you don’t have dev mode apps exposed to the public, this isn’t a huge deal, though is still something worth fixing.

[Read more](https://groups.google.com/forum/#!topic/rubyonrails-security/IsQKvDqZdKw)

---

☝️ _**Be sure to check out [Sharesecret](https://www.sharesecret.co), which makes it easy to securely share sensitive data.**_