GitHub Advisoryadvisory · RubyGems

GHSA-m42x-37p3-fv5w Circumvention of file size limits in ActiveStorage

HIGH Published 2020-05-26 Modified 2023-07-05 Official page ↗
Aliases
CVE-2020-8162
Ecosystem
RubyGems
Packages
activestorage
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-434, CWE-602
Reviewed
2020-05-26

Affected packages

• RubyGems activestorage: >= 5.0.0, < 5.2.4.3 → fixed in 5.2.4.3 • RubyGems activestorage: >= 6.0.0, < 6.0.3.1 → fixed in 6.0.3.1

Description

There is a vulnerability in ActiveStorage's S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user. Versions Affected: rails = 5.2.4.3, rails >= 6.0.3.1 Impact ------ Utilizing this vulnerability, an attacker can control the Content-Length of an S3 direct upload URL without receiving a new signature from the server. This could be used to bypass controls in place on the server to limit upload size. Workarounds ----------- This is a low-severity security issue. As such, no workaround is necessarily until such time as the application can be upgraded.

Related

Alias · CVE (1)

  • CVE-2020-8162 A client side enforcement of server side security vulnerability exists in rails < 5.2.4.2 and rails < 6.0.3.1 ActiveStorage's S3 adapter… vulnerability

Weakness · CWE (2)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness
  • CWE-602 Client-Side Enforcement of Server-Side Security weakness

References