CVE-2024-32978

What it actually does

Insecure file permissions on specific Ruby files in the Kaminari gem allow unauthorized write access, enabling modification of pagination logic or related application behavior.

Why it matters to the business

Attackers could alter web application behavior or compromise data integrity in Rails apps using this library, leading to reliability issues, potential data tampering, and increased operational risk across dependent systems.

How an attack unfolds

An attacker with local or shared filesystem access locates the installed Kaminari gem, identifies Ruby files with overly permissive permissions, and directly edits them to inject malicious code or change pagination behavior.

How to fix it

Upgrade Kaminari to version 0.16.2 or later. If immediate upgrade is not possible, review and restrict file permissions on affected Ruby files to ensure only authorized users can write.

How to confirm the fix worked

Confirm installed version is 0.16.2 or higher via gem list or bundler output; verify file permissions on Kaminari Ruby files are set to restrictive modes such as 644 or owner-write-only.

Typical attack path

1. Locate Kaminari gem installation directory on the target system
2. Identify Ruby source files with insecure permissions
3. Modify file contents to alter library behavior or inject payloads
4. Trigger application code paths that invoke the modified pagination logic

How to detect it

Review system and application logs for unexpected modifications to files within Kaminari gem directories; inspect file permission settings on library installations and look for evidence of unauthorized edits to Ruby source files.

What your security team should do

• Prioritize upgrade to Kaminari 0.16.2 or later across all Rails applications
• Audit gem installations for correct file permissions and remediate any overly permissive settings
• Implement monitoring for unexpected changes to library files in production environments