CVE-2012-3424: Medium severity rubyonrails Rails vulnerability
tenderlove reports:
DoS Vulnerability in authenticateorrequestwithhttpdigest
There is a DoS vulnerability in Action Pack digest authentication handling in Rails. This vulnerability has been assigned the CVE identifier CVE-2012-3424.
Versions Affected: 3.x. Not affected: 2.3.5 - 2.3.14 Fixed Versions: 3.0.16, 3.1.7, 3.2.7
Impact ------
All users using Digest Authentication support in Rails should upgrade immediately. Impacted code uses any of the withhttpdigest controller helper methods. For example:
class MyController < ApplicationController def index authenticateorrequestwithhttpdigest(REALM) do |uname| # ... end end end
Releases -------- The 3.0.16, 3.1.7 & 3.2.7 releases are available at the normal locations.
Workarounds ----------- There are no feasible workarounds for this issue.
Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.
3-0-digestauthdos.patch - Patch for 3.0 series 3-1-digestauthdos.patch - Patch for 3.1 series 3-2-digestauthdos.patch - Patch for 3.2 series
Please note that only the 3.1.x and 3.2.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.
Credits ------- Thanks to Charlie Somerville for reporting this issue!
References:
http://weblog.rubyonrails.org/2012/7/26/ann-rails-3-2-7-has-been-released/ https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/vxJjrc15qYM
diff --git a/actionpack/lib/actioncontroller/metal/httpauthentication.rb b/actionpack/lib/actioncontroller/metal/httpauthentication.rb index 9f2f547..fe4ab65 100644 --- a/actionpack/lib/actioncontroller/metal/httpauthentication.rb +++ b/actionpack/lib/actioncontroller/metal/httpauthentication.rb @@ -227,9 +227,9 @@ module ActionController end def decodecredentials(header) - Hash[header.tos.gsub(/^Digest\s+/,'').split(',').map do |pair| + HashWithIndifferentAccess[header.tos.gsub(/^Digest\s+/,'').split(',').map do |pair| key, value = pair.split('=', 2) - [key.strip.tosym, value.tos.gsub(/^"|"$/,'').gsub(/'/, '')] + [key.strip, value.tos.gsub(/^"|"$/,'').delete('\'')] end] end
Other sources
The decodecredentials method in actionpack/lib/actioncontroller/metal/httpauthentication.rb in Ruby on Rails before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts Digest Authentication strings to symbols, which allows remote attackers to cause a denial of service by leveraging access to an application that uses a withhttpdigest helper method, as demonstrated by the authenticateorrequestwithhttpdigest method.
— GitHub
The decodecredentials method in actionpack/lib/actioncontroller/metal/httpauthentication.rb in Ruby on Rails 3.x before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts Digest Authentication strings to symbols, which allows remote attackers to cause a denial of service by leveraging access to an application that uses a withhttpdigest helper method, as demonstrated by the authenticateorrequestwithhttpdigest method.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-3424?
CVE-2012-3424 is classified as a Denial of Service (DoS) vulnerability affecting Ruby on Rails.
How do I fix CVE-2012-3424?
To remediate CVE-2012-3424, upgrade to rubygem-actionpack version 3.0.16, 3.1.7, or 3.2.7, or any higher version.
Which versions of Ruby on Rails are affected by CVE-2012-3424?
CVE-2012-3424 affects Ruby on Rails versions prior to 3.0.16, 3.1.7, and 3.2.7.
Is CVE-2012-3424 related to authentication processes in Rails?
Yes, CVE-2012-3424 specifically impacts the digest authentication handling in Action Pack.
What area of the Ruby on Rails application does CVE-2012-3424 target?
CVE-2012-3424 targets the authentication process within Ruby on Rails applications, leading to potential service disruption.