CVE-2012-2661: SQL Injection
A security flaw was found in the way rubygem-activerecord, the ActiveRecord pattern for ORM, performed SQL query generation based on the content of params hash, when nested query paramaters were provided. If a Ruby on Rails application directly passed request params to the 'where' method of an ActiveRecord class, a remote attacker could use this flaw to cause the 'params[:id]' to return a specially-crafted hash, resulting into the WHERE clause of the SQL statement to query an arbitrary table with value of attacker's choice, leading to disclosure of sensitive information.
Upstream advisory announcement: [1] http://groups.google.com/group/rubyonrails-security/browsethread/thread/7546a238e1962f59
Relevant patches: [2] http://groups.google.com/group/rubyonrails-security/attach/fc2da6c627fc92df/3-0-paramssqlinjection.patch?part=3 (against v3.0 branch) [3] http://groups.google.com/group/rubyonrails-security/attach/fc2da6c627fc92df/3-1-paramssqlinjection.patch?part=4 (against v3.1 branch) [4] http://groups.google.com/group/rubyonrails-security/attach/fc2da6c627fc92df/3-2-paramssqlinjection.patch?part=5 (against v3.2 branch)
Other sources
The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage unintended recursion, a related issue to CVE-2012-2695.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-2661?
CVE-2012-2661 has been classified as a medium severity vulnerability due to potential SQL injection risks.
How do I fix CVE-2012-2661?
To mitigate CVE-2012-2661, upgrade rubygem-actionpack to version 3.0.13 or later, or apply appropriate patches provided by the vendor.
Which Ruby on Rails versions are affected by CVE-2012-2661?
CVE-2012-2661 affects Ruby on Rails versions prior to 3.1.5, specifically 3.0.x series.
What type of vulnerability is CVE-2012-2661?
CVE-2012-2661 is an SQL injection vulnerability that can be exploited through improperly handled parameters.
How can CVE-2012-2661 impact my application?
Exploitation of CVE-2012-2661 could allow attackers to execute arbitrary SQL queries, potentially leading to unauthorized access to database information.