CVE-2025-55193

Executive Summary

CVE-2025-55193 is a security advisory affecting Ruby on Rails' Active Record component. The vulnerability allows an attacker to inject unescaped ANSI escape sequences into application logs via the id parameter passed to methods like find. This can lead to log injection attacks, potentially corrupting log files, hiding malicious activity, or causing terminal emulators to execute arbitrary commands when logs are viewed. The issue is patched in Rails versions 7.1.5.2, 7.2.2.2, and 8.0.2.1.

Supply Chain & Package Security

This vulnerability affects the Ruby on Rails framework, specifically the activerecord gem. Organizations using Rails should immediately update to the patched versions. The attack vector is through user-supplied input that is logged without sanitization, making it a supply chain risk for any application using vulnerable Rails versions.

CVSS Breakdown & Threat Level

The CVSS score is currently 0.0, indicating that a full vector has not been assigned. However, based on the nature of the vulnerability, a reasonable assessment would be:

• Attack Vector (AV): Network (N) - The attacker can send a crafted request over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): Required (R) - A user must view the logs for impact.
• Scope (S): Changed (C) - The vulnerability impacts the logging system, not the database.
• Confidentiality (C): None (N) - No direct data breach.
• Integrity (I): Low (L) - Logs can be corrupted or hidden.
• Availability (A): Low (L) - Logs may be rendered unreadable.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L

Threat Level: Medium. While the direct impact is limited to log integrity, the ability to hide malicious activity makes this a significant concern for security monitoring.

Deep Dive & Mechanics

The vulnerability lies in how Active Record logs database queries. When a method like find is called with an id parameter, that parameter is included in the log message. If the id contains ANSI escape sequences (e.g., \x1b[2J to clear screen), these sequences are passed directly to the log output without sanitization.

Attack Scenario:

1. An attacker sends a request with a crafted id parameter containing ANSI escape codes.
2. The Rails application logs the query, including the malicious id.
3. When an administrator or monitoring tool views the log file in a terminal, the ANSI sequences are interpreted.
4. This can clear the terminal, hide previous log entries, or even execute commands (if the terminal supports it).

Technical Details:

• The vulnerable code is in activerecord/lib/active_record/log_subscriber.rb.
• The id parameter is interpolated into the log message without escaping.
• ANSI escape sequences start with \x1b[ (ESC) followed by control characters.

Vulnerable vs. Patched Code

Vulnerable Code (Rails < 7.1.5.2):

# activerecord/lib/active_record/log_subscriber.rb
def sql(event)
  payload = event.payload
  name = payload[:name]
  sql = payload[:sql]
  binds = payload[:binds]
  # ...
  log = "#{name} (#{duration}) #{sql} #{binds}"
  # No sanitization of binds
  debug(log)
end

Patched Code (Rails >= 7.1.5.2):

# activerecord/lib/active_record/log_subscriber.rb
def sql(event)
  payload = event.payload
  name = payload[:name]
  sql = payload[:sql]
  binds = payload[:binds]
  # ...
  # Sanitize binds to remove ANSI escape sequences
  sanitized_binds = binds.map { |b| b.to_s.gsub(/\e\[[0-9;]*[a-zA-Z]/, '') }
  log = "#{name} (#{duration}) #{sql} #{sanitized_binds}"
  debug(log)
end

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install a vulnerable Rails version (e.g., 7.1.5.1).
2. Create a simple model (e.g., User) with a find endpoint.
3. Use a tool like curl to send a crafted request.

Exploit Payload:

curl -X GET "http://target/users/1%1B%5B2J"  # URL-encoded ANSI clear screen

Expected Result: When the server log is viewed in a terminal, the screen will clear, hiding previous log entries.

Blue Team

Detection:

• Monitor logs for ANSI escape sequences (e.g., \x1b[ or \e[).
• Use log analysis tools that strip or escape control characters.
• Implement input validation to reject or sanitize ANSI sequences.

Mitigation:

• Immediately update Rails to patched versions.
• Use a log shipper that sanitizes control characters.
• Restrict access to log files.

Indicators of Compromise (IOCs)

• Log Entries: Look for ANSI escape sequences in log files, such as \x1b[2J (clear screen), \x1b[A (cursor up), or \x1b[0m (reset).
• Network Traffic: Requests with URL-encoded ANSI sequences in parameters (e.g., %1B%5B).
• File Integrity: Log files that appear truncated or have unusual formatting.

Detection Engineering

YARA Rule

rule Detect_ANSI_Log_Injection {
  meta:
    description = "Detects ANSI escape sequences in log files"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2025-55193"
  strings:
    $ansi1 = /\x1b\[[0-9;]*[a-zA-Z]/
    $ansi2 = /\e\[[0-9;]*[a-zA-Z]/
  condition:
    any of them
}

Sigma Rule

title: Detect ANSI Escape Sequences in Rails Logs
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects ANSI escape sequences in Rails application logs
author: Valters IT
date: 2025-04-10
logsource:
  category: application
  product: rails
detection:
  selection:
    - EventID: 100  # Example event ID for Rails logs
    - Message|contains: 
        - '\x1b['
        - '\e['
  condition: selection
falsepositives:
  - Legitimate use of ANSI codes in log messages (rare)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-55193 Rails Log Injection Attempt"; flow:to_server,established; content:"%1B%5B"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Rails to version 7.1.5.2, 7.2.2.2, or 8.0.2.1.
2. If immediate update is not possible, implement a WAF rule to block ANSI escape sequences in request parameters.
3. Review and sanitize all log inputs.

Long-term Measures:

• Use a centralized logging system that strips control characters.
• Implement input validation for all user-supplied data.
• Regularly audit log files for anomalies.

Patch Command:

gem update rails
# Or in Gemfile:
gem 'rails', '~> 7.1.5.2'

Valters IT signature: This report is generated for educational and defensive purposes. Always follow responsible disclosure.