Listen to this Post
The vulnerability exists in the `Alchemy::ResourcesHelperresource_url_proxy` method within the AlchemyCMS Ruby on Rails application. This helper method uses the Ruby `eval()` function to dynamically execute a string value taken from a `resource_handler` object’s `engine_name` attribute. The `engine_name` is intended to refer to a Rails engine but is sourced from module definitions which can be configured by an administrative user. An authenticated attacker with the ability to modify these configurations can control the string passed to eval(). Since `eval()` executes any Ruby code provided, this allows the attacker to break out of the intended context, bypass the Ruby sandbox, and execute arbitrary operating system commands on the underlying server hosting the AlchemyCMS application. The exploit requires authenticated access and the ability to influence the module configuration, which may involve local file access to manipulate source files or administrative control within the CMS.
Platform: AlchemyCMS
Version: <7.4.12, <8.0.3
Vulnerability: RCE via eval()
Severity: Critical
Date: 2026-01-XX
Prediction: 2026-01-31
What Undercode Say:
Check application version grep "version" Gemfile.lock Search for vulnerable code pattern grep -r "eval.engine_name" app/ Verify patch git log --oneline | grep -i "security|eval|23885"
Proof-of-Concept snippet handler = OpenStruct.new(engine_name: "<code>id > /tmp/pwned</code>") eval(handler.engine_name)
How Exploit:
1. Attacker gains authenticated admin access.
- Modifies a module’s configuration to inject malicious Ruby code into the `engine_name` parameter.
- Triggers the `resource_url_proxy` method, executing the payload via
eval(). - Payload executes arbitrary system commands (e.g.,
touch /tmp/rce_success).
Protection from this CVE:
Update to AlchemyCMS version 7.4.12 or 8.0.3, which replace the `eval()` call with a safe alternative. Restrict administrative access and audit module configuration files for unauthorized changes.
Impact:
Authenticated Remote Code Execution leading to full server compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
