CVE-2012-2660: Medium severity rubyonrails Rails vulnerability
actionpack/lib/actiondispatch/http/request.rb in Ruby on Rails before 2.3.16, 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain [nil] values, a related issue to CVE-2012-2694.
Other sources
A security flaw was found in the way rubygem-actionpack, the web-flow and rendering framework putting the VC in MVC, performed SQL query generation based on the content of params hash. If a Ruby on Rails application used Rack to parse query parameters, those parameters were not sanitized for the presence of the 'nil' value and that application relied, when performing user authentication, certain params value not to be 'nil', a remote attacker could use this flaw to bypass the authentication, leading to information disclosure and / or unauthorized access to the service.
Upstream advisory announcement: [1] http://groups.google.com/group/rubyonrails-security/browsethread/thread/f1203e3376acec0f
Relevant patches: [2] http://groups.google.com/group/rubyonrails-security/attach/d890f8d58b5fbf32/3-0-nullparam.patch?part=3 (against v3.0 branch) [3] http://groups.google.com/group/rubyonrails-security/attach/d890f8d58b5fbf32/3-1-nullparam.patch?part=5 (against v3.1 branch) [4] http://groups.google.com/group/rubyonrails-security/attach/d890f8d58b5fbf32/3-2-nullparam.patch?part=4 (against v3.2 branch)
actionpack/lib/actiondispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2694.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-2660?
CVE-2012-2660 has a medium severity level as it allows potential remote code execution due to inadequate parameter handling in Ruby on Rails.
How do I fix CVE-2012-2660?
To fix CVE-2012-2660, upgrade Ruby on Rails to version 2.3.16, 3.0.13, 3.1.5, or 3.2.4 or later.
Which versions of Ruby on Rails are affected by CVE-2012-2660?
CVE-2012-2660 affects Ruby on Rails versions before 2.3.16, 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4.
What could happen if I do not address CVE-2012-2660?
Failing to address CVE-2012-2660 may allow attackers to exploit the vulnerability to perform denial-of-service attacks or execute arbitrary code.
Are there any workaround solutions for CVE-2012-2660 until I can upgrade?
There are no recommended workaround solutions for CVE-2012-2660, so it is crucial to update to a patched version as soon as possible.