Arbitrary Code Injection Affecting actionpack package, versions >=4.0.0, <4.1.14.2 >=4.2.0, <4.2.5.2 >=3.2.0.rc1, <3.2.22.2

actionpack is a web app builder and tester on Rails. Affected versions of this Gem are vulnerable to Arbitrary Code Injection.

Applications that pass unverified user input to the render method in a controller or a view may be vulnerable to a code injection.

Impacted code will look like this:

class TestController < ApplicationController
  def show
    render params[:id]
  end
end

An attacker could use the request parameters to coerce the above example to execute arbitrary ruby code.

All users running an affected release should either upgrade or use one of the workarounds immediately.

• Rubysec Security Advisory
• Google Forum