CVE-2022-32224

What it actually does

Unsafe YAML deserialization of attacker-controlled data stored in Active Record serialized columns allows instantiation of arbitrary Ruby objects and subsequent remote code execution.

Why it matters to the business

Attackers with database write access can achieve full application server takeover, leading to data theft, service disruption, or further lateral movement; the vulnerability is long-public with public exploits available, increasing risk for any unpatched Rails deployments using YAML serialization.

How an attack unfolds

An attacker first obtains the ability to write arbitrary data into a database column used for YAML serialization (commonly via SQL injection or compromised application credentials), places a malicious YAML payload containing a gadget chain that triggers code execution upon load, and then causes the application to load and deserialize the column during normal operation.

How to fix it

Upgrade Active Record to a fixed release: 7.0.3.1 or newer, 6.1.6.1 or newer, 6.0.5.1 or newer, or 5.2.8.1 or newer; apply the commit 8030cff808657faa44828de001cd3b80364597de in rails/rails and restart all application instances; avoid using YAML as a serialization format for any user-influenced data.

How to confirm the fix worked

Inventory all Rails applications and confirm Active Record version is at or above the listed fixed releases; search code and schema for uses of serialize :column, YAML and replace with safe alternatives; run dependency scanners against Gemfile.lock to verify no vulnerable rails versions remain.

Typical attack path

1. Obtain database write capability through SQL injection or credential compromise
2. Craft and insert a malicious YAML object into a serialized column
3. Trigger application code path that performs YAML.load on the column
4. Execute arbitrary Ruby code via the deserialized gadget chain
5. Establish persistence or exfiltrate data from the compromised Rails process

How to detect it

Review application and database logs for unexpected changes to columns known to use YAML serialization; search process execution logs and Rails logs for evidence of YAML.load calls loading data that was recently modified via non-application paths; monitor for child processes spawned by the Rails application worker that are inconsistent with normal operation.

What your security team should do

• Immediately upgrade all Rails applications to the patched Active Record versions listed in remediation guidance
• Audit database columns used with YAML serialization and migrate to JSON or safe custom serializers
• Implement web application firewall rules or input validation to block obvious SQL injection attempts that could lead to column manipulation
• Enable and review Rails deserialization-related logging for anomalous object loads
• Treat any application still on versions older than 5.2.8.1 as high priority for emergency patching given public exploit availability