Miggo Logo
Miggo Vulnerability Database
→
CVE-2018-12028

CVE-2018-12028: Incorrect Access Control in Phusion Passenger

7.8

CVSS Score
3.0

Basic Information

CVE ID
CVE-2018-12028
GHSA ID
GHSA-jjhj-8gx7-x836
EPSS Score
0.3966%
CWE
CWE-732
Published
5/13/2022
Updated
7/9/2023
KEV Status
No
Technology
TechnologyRuby

Technical Details

CVSS Vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
passengerrubygems>= 5.3.0, < 5.3.25.3.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the order of operations in handling the preloader's reported PID. The original code in SmartSpawner.h (lines 843-850) created a ScopeGuard to kill the PID immediately after receiving it, before performing UID validation. The patch moved this guard after the validation checks (lines 941-943 in the diff). This confirms that the pre-patch code allowed killing unvalidated PIDs, directly enabling the exploit described in CVE-2018-12028. The CWE-732 mapping (incorrect permission/resource control) aligns with the lack of PID validation before taking destructive actions.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*n In*orr**t ****ss *ontrol vuln*r**ility in Sp*wnin*Kit in P*usion P*ss*n**r *.*.x ***or* *.*.* *llows * P*ss*n**r-m*n**** m*li*ious *ppli**tion, upon sp*wnin* * **il* pro**ss, to r*port *n *r*itr*ry *i***r*nt PI* ***k to P*ss*n**r's pro**ss m*n***r

Reasoning

T** vuln*r**ility st*ms *rom t** or**r o* op*r*tions in **n*lin* t** pr*lo***r's r*port** PI*. T** ori*in*l *o** in `Sm*rtSp*wn*r.*` (lin*s ***-***) *r**t** * `S*op**u*r*` to kill t** PI* imm**i*t*ly **t*r r***ivin* it, ***or* p*r*ormin* UI* v*li**ti