CVE-2022-32224: Active Record YAML Serialization RCE Flaw

CVE-2022-32224 Overview

A critical insecure deserialization vulnerability exists in Ruby on Rails Active Record when using YAML serialized columns. This vulnerability allows an attacker who can manipulate data in the database (through means such as SQL injection) to escalate their attack to achieve Remote Code Execution (RCE). The vulnerability affects multiple versions of Active Record, making it a significant security concern for Ruby on Rails applications that utilize YAML serialization for database columns.

Critical Impact

Attackers with database access can escalate to full Remote Code Execution by exploiting unsafe YAML deserialization in Active Record serialized columns.

Affected Products

• Active Record versions prior to 7.0.3.1
• Active Record versions prior to 6.1.6.1
• Active Record versions prior to 6.0.5.1
• Active Record versions prior to 5.2.8.1

Discovery Timeline

• 2022-12-05 - CVE-2022-32224 published to NVD
• 2025-04-24 - Last updated in NVD database

Technical Details for CVE-2022-32224

Vulnerability Analysis

This vulnerability stems from unsafe YAML deserialization in Active Record's serialized column functionality. When Active Record deserializes YAML data from database columns, it can instantiate arbitrary Ruby objects, which can lead to code execution if an attacker can control the serialized data.

The attack requires the adversary to first gain the ability to write arbitrary data to the database. This is commonly achieved through SQL injection vulnerabilities or compromised database credentials. Once the attacker can modify the serialized YAML content stored in database columns, they can craft malicious YAML payloads that, when deserialized by Active Record, execute arbitrary code on the server.

This represents a classic insecure deserialization pattern (CWE-502) where untrusted data is processed by a serialization framework without proper validation. The network-accessible nature of web applications combined with the potential for SQL injection makes this a particularly dangerous vulnerability.

Root Cause

The root cause is the unsafe deserialization of YAML content stored in Active Record serialized columns. YAML in Ruby supports object instantiation during parsing, which means specially crafted YAML payloads can trigger arbitrary code execution when deserialized. Prior to the patched versions, Active Record did not restrict the types of objects that could be instantiated during YAML deserialization, allowing attackers to leverage this capability for RCE.

Attack Vector

The attack vector is network-based and requires the attacker to first compromise the database or have the ability to inject malicious data into serialized columns. The typical attack chain involves:

1. Exploiting a SQL injection vulnerability or obtaining database access through other means
2. Inserting malicious YAML payload into a serialized column
3. Triggering the application to read and deserialize the compromised data
4. Achieving code execution when the malicious YAML payload is processed

The vulnerability mechanism involves crafting YAML that includes embedded Ruby objects with dangerous initialization or callback methods. When Active Record deserializes this YAML, the malicious objects are instantiated and their code is executed in the context of the Rails application. For detailed technical analysis, refer to the Ruby on Rails Security Discussion.

Detection Methods for CVE-2022-32224

Indicators of Compromise

• Unusual or malformed YAML content in database columns that contain serialized data
• Database queries attempting to modify serialized columns with unexpected payloads
• Application errors related to YAML parsing or unexpected object instantiation
• Signs of SQL injection attempts targeting tables with serialized columns

Detection Strategies

• Monitor application logs for YAML deserialization errors or unexpected class instantiation
• Implement database activity monitoring to detect suspicious modifications to serialized columns
• Deploy Web Application Firewalls (WAF) configured to detect SQL injection patterns
• Use runtime application self-protection (RASP) solutions to monitor deserialization operations

Monitoring Recommendations

• Enable verbose logging for Active Record operations involving serialized attributes
• Implement integrity monitoring for critical database tables containing serialized data
• Set up alerts for failed deserialization attempts or unexpected object types during YAML processing
• Monitor for SQL injection attack patterns in application and web server logs

How to Mitigate CVE-2022-32224

Immediate Actions Required

• Upgrade Active Record to a patched version: 7.0.3.1, 6.1.6.1, 6.0.5.1, or 5.2.8.1 or later
• Audit your application for SQL injection vulnerabilities that could enable database manipulation
• Review database access controls and ensure principle of least privilege
• Consider migrating serialized columns from YAML to JSON format where possible

Patch Information

The vulnerability has been addressed in Active Record versions 7.0.3.1, 6.1.6.1, 6.0.5.1, and 5.2.8.1. The patched versions introduce safer YAML deserialization that restricts the types of objects that can be instantiated. Organizations should update to these versions or later as soon as possible.

For detailed patch information and security advisories, refer to:

• GitHub Security Advisory GHSA-3hhc-qp5v-9p2j
• Ruby on Rails Security Discussion

Workarounds

• Migrate from YAML serialization to JSON serialization for database columns where feasible
• Implement additional input validation and sanitization for any data paths leading to the database
• Consider using the safe_load method for YAML parsing with explicit permitted classes
• Deploy additional security layers such as database firewalls to restrict unauthorized data modifications

# Update Gemfile to use patched Active Record version
# For Rails 7.x:
bundle update activerecord --conservative
# Verify installed version
bundle exec gem list activerecord
# Expected output should show version >= 7.0.3.1 (or corresponding patched version for your Rails series)