A critical code injection vulnerability in the Savon Ruby SOAP client could allow remote attackers to execute arbitrary code on the host system.

This is a code injection vulnerability (CWE-94) stemming from improper control of generation of code. The vulnerability is exploitable by an unauthenticated remote attacker, though the complexity is considered high.

Code injection vulnerabilities are extremely severe, as they allow for full remote code execution (RCE) on the server. This can lead to total system compromise, data exfiltration, and lateral movement within the network. Despite the high complexity rating, the CVSS score of 8.1 reflects the catastrophic potential impact on the business.

Immediate Action: Update the Savon gem to version 2.17.2 or later.

Proactive Monitoring: Monitor for unusual outbound network connections from the application server, which may indicate command-and-control communication following a successful injection.

Compensating Controls: Ensure the application runs within a containerized or sandboxed environment to limit the reach of an attacker if code execution occurs.

Public Exploit Available: Unknown

Given the potential for complete system takeover, upgrading the Savon library is a mandatory security requirement. Security teams should verify the version in use across all development and production environments and apply the patch as soon as possible.