REDHAT-BUG-966804: Medium severity Ruby on Rails Rails vulnerability

Ramon de C Valle (rcvalle) reports:

There is a mass assignment vulnerability in the create method of the UsersController controller.

The create method in app/controllers/userscontroller.rb deletes the user-controlled user[admin] parameter from the params hash but saves it to a local variable and assigns it to the newly created user object bypassing the :attrprotected mechanism.

def create admin = params[:user].delete :admin @user = User.new(params[:user]){|u| u.admin = admin } if @user.save @user.roles << Role.findbyname("Anonymous") unless @user.roles.map(&:name).include? "Anonymous" processsuccess else processerror end end

Any non-admin user with permissions to create other (non-admin) users (i.e. with Manager role) can create arbitrary admin users by sending a specially-crafted POST request.