CVE-2022-32224 (GCVE-0-2022-32224)
Vulnerability from cvelistv5 – Published: 2022-12-05 00:00 – Updated: 2025-04-24 15:17
VLAI?
Summary
A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2.8.1 which could allow an attacker, that can manipulate data in the database (via means like SQL injection), the ability to escalate to an RCE.
Severity ?
9.8 (Critical)
CWE
- CWE-502 - Deserialization of Untrusted Data (CWE-502)
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| n/a | https://github.com/rails/rails |
Affected:
7.0.3.1, 6.1.6.1, 6.0.5.1, 5.2.8.1
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T07:32:56.015Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/advisories/GHSA-3hhc-qp5v-9p2j"
},
{
"tags": [
"x_transferred"
],
"url": "https://groups.google.com/g/rubyonrails-security/c/MmFO3LYQE8U"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2022-32224",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-24T15:17:17.965566Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-24T15:17:29.382Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "https://github.com/rails/rails",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "7.0.3.1, 6.1.6.1, 6.0.5.1, 5.2.8.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record \u003c 7.0.3.1, \u003c6.1.6.1, \u003c6.0.5.1 and \u003c5.2.8.1 which could allow an attacker, that can manipulate data in the database (via means like SQL injection), the ability to escalate to an RCE."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "Deserialization of Untrusted Data (CWE-502)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-12-05T00:00:00.000Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://github.com/advisories/GHSA-3hhc-qp5v-9p2j"
},
{
"url": "https://groups.google.com/g/rubyonrails-security/c/MmFO3LYQE8U"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2022-32224",
"datePublished": "2022-12-05T00:00:00.000Z",
"dateReserved": "2022-06-01T00:00:00.000Z",
"dateUpdated": "2025-04-24T15:17:29.382Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:activerecord_project:activerecord:*:*:*:*:*:ruby:*:*\", \"versionEndExcluding\": \"5.2.8.1\", \"matchCriteriaId\": \"49ED831D-395F-4B7C-8388-F5444C2791EC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:activerecord_project:activerecord:*:*:*:*:*:ruby:*:*\", \"versionStartIncluding\": \"6.0.0\", \"versionEndExcluding\": \"6.0.5.1\", \"matchCriteriaId\": \"C20A0930-5A11-441C-AD56-1605DA61A2EF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:activerecord_project:activerecord:*:*:*:*:*:ruby:*:*\", \"versionStartIncluding\": \"6.1.0\", \"versionEndExcluding\": \"6.1.6.1\", \"matchCriteriaId\": \"05750DC8-484A-4C65-91C2-400C4EFA839F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:activerecord_project:activerecord:*:*:*:*:*:ruby:*:*\", \"versionStartIncluding\": \"7.0.0\", \"versionEndExcluding\": \"7.0.3.1\", \"matchCriteriaId\": \"A3B8830F-EBB1-4EAC-A828-921F79D55765\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record \u003c 7.0.3.1, \u003c6.1.6.1, \u003c6.0.5.1 and \u003c5.2.8.1 which could allow an attacker, that can manipulate data in the database (via means like SQL injection), the ability to escalate to an RCE.\"}, {\"lang\": \"es\", \"value\": \"Existe una posible escalada a la vulnerabilidad RCE cuando se utilizan columnas serializadas YAML en Active Record \u0026lt; 7.0.3.1, \u0026lt;6.1.6.1, \u0026lt;6.0.5.1 y \u0026lt;5.2.8.1, lo que podr\\u00eda permitir a un atacante, que puede manipular datos en la base de datos (a trav\\u00e9s de medios como la inyecci\\u00f3n SQL), la capacidad de escalar a un RCE.\"}]",
"id": "CVE-2022-32224",
"lastModified": "2024-11-21T07:05:57.577",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}]}",
"published": "2022-12-05T22:15:10.397",
"references": "[{\"url\": \"https://github.com/advisories/GHSA-3hhc-qp5v-9p2j\", \"source\": \"support@hackerone.com\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://groups.google.com/g/rubyonrails-security/c/MmFO3LYQE8U\", \"source\": \"support@hackerone.com\", \"tags\": [\"Exploit\", \"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/advisories/GHSA-3hhc-qp5v-9p2j\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://groups.google.com/g/rubyonrails-security/c/MmFO3LYQE8U\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Mailing List\", \"Third Party Advisory\"]}]",
"sourceIdentifier": "support@hackerone.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"support@hackerone.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-502\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-502\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2022-32224\",\"sourceIdentifier\":\"support@hackerone.com\",\"published\":\"2022-12-05T22:15:10.397\",\"lastModified\":\"2025-04-24T16:15:19.480\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record \u003c 7.0.3.1, \u003c6.1.6.1, \u003c6.0.5.1 and \u003c5.2.8.1 which could allow an attacker, that can manipulate data in the database (via means like SQL injection), the ability to escalate to an RCE.\"},{\"lang\":\"es\",\"value\":\"Existe una posible escalada a la vulnerabilidad RCE cuando se utilizan columnas serializadas YAML en Active Record \u0026lt; 7.0.3.1, \u0026lt;6.1.6.1, \u0026lt;6.0.5.1 y \u0026lt;5.2.8.1, lo que podr\u00eda permitir a un atacante, que puede manipular datos en la base de datos (a trav\u00e9s de medios como la inyecci\u00f3n SQL), la capacidad de escalar a un RCE.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"support@hackerone.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-502\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-502\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:activerecord_project:activerecord:*:*:*:*:*:ruby:*:*\",\"versionEndExcluding\":\"5.2.8.1\",\"matchCriteriaId\":\"49ED831D-395F-4B7C-8388-F5444C2791EC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:activerecord_project:activerecord:*:*:*:*:*:ruby:*:*\",\"versionStartIncluding\":\"6.0.0\",\"versionEndExcluding\":\"6.0.5.1\",\"matchCriteriaId\":\"C20A0930-5A11-441C-AD56-1605DA61A2EF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:activerecord_project:activerecord:*:*:*:*:*:ruby:*:*\",\"versionStartIncluding\":\"6.1.0\",\"versionEndExcluding\":\"6.1.6.1\",\"matchCriteriaId\":\"05750DC8-484A-4C65-91C2-400C4EFA839F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:activerecord_project:activerecord:*:*:*:*:*:ruby:*:*\",\"versionStartIncluding\":\"7.0.0\",\"versionEndExcluding\":\"7.0.3.1\",\"matchCriteriaId\":\"A3B8830F-EBB1-4EAC-A828-921F79D55765\"}]}]}],\"references\":[{\"url\":\"https://github.com/advisories/GHSA-3hhc-qp5v-9p2j\",\"source\":\"support@hackerone.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://groups.google.com/g/rubyonrails-security/c/MmFO3LYQE8U\",\"source\":\"support@hackerone.com\",\"tags\":[\"Exploit\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/advisories/GHSA-3hhc-qp5v-9p2j\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://groups.google.com/g/rubyonrails-security/c/MmFO3LYQE8U\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Mailing List\",\"Third Party Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/advisories/GHSA-3hhc-qp5v-9p2j\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://groups.google.com/g/rubyonrails-security/c/MmFO3LYQE8U\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T07:32:56.015Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-32224\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-04-24T15:17:17.965566Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-04-24T15:17:25.746Z\"}}], \"cna\": {\"affected\": [{\"vendor\": \"n/a\", \"product\": \"https://github.com/rails/rails\", \"versions\": [{\"status\": \"affected\", \"version\": \"7.0.3.1, 6.1.6.1, 6.0.5.1, 5.2.8.1\"}]}], \"references\": [{\"url\": \"https://github.com/advisories/GHSA-3hhc-qp5v-9p2j\"}, {\"url\": \"https://groups.google.com/g/rubyonrails-security/c/MmFO3LYQE8U\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record \u003c 7.0.3.1, \u003c6.1.6.1, \u003c6.0.5.1 and \u003c5.2.8.1 which could allow an attacker, that can manipulate data in the database (via means like SQL injection), the ability to escalate to an RCE.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-502\", \"description\": \"Deserialization of Untrusted Data (CWE-502)\"}]}], \"providerMetadata\": {\"orgId\": \"36234546-b8fa-4601-9d6f-f4e334aa8ea1\", \"shortName\": \"hackerone\", \"dateUpdated\": \"2022-12-05T00:00:00.000Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2022-32224\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-04-24T15:17:29.382Z\", \"dateReserved\": \"2022-06-01T00:00:00.000Z\", \"assignerOrgId\": \"36234546-b8fa-4601-9d6f-f4e334aa8ea1\", \"datePublished\": \"2022-12-05T00:00:00.000Z\", \"assignerShortName\": \"hackerone\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}