ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML.
Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for remote attackers to conduct SQL injection attacks via a non-numeric argument.
actionpack/lib/actionview/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not properly implement filters associated with the list of available templates, which allows remote attackers to bypass intended access restrictions via an action name that uses an unintended case for alphabetic characters.
SQL injection vulnerability in the Active Record component in Ruby on Rails before 2.3.15, 3.0.x before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain findby method calls.
An SQL injection vulnerability in the quotetablename method could allow malicious users to inject arbitrary SQL into a query [1].
This is corrected in upstream 3.0.10, 2.3.13, and 3.1.0rc5 versions. Patches are available in the advisory [1] and in git [2].
[1] http://groups.google.com/group/rubyonrails-security/browsethread/thread/6a1e473744bc389b [2] https://github.com/rails/rails/commit/8a39f411dc3c806422785b1f4d5c7c9d58e4bf85
SQL injection vulnerability in activerecord/lib/activerecord/connectionadapters/postgresqladapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting.
lib/activesupport/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.
activesupport/coreext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged (1) AJAX or (2) API requests that leverage "combinations of browser plugins and HTTP redirects," a related issue to CVE-2011-0696.
Damien Mathieu (42) reports:
Unsafe Query Generation Risk in Ruby on Rails
There is a vulnerability when Active Record is used in conjunction with JSON parameter parsing. This vulnerability has been assigned the CVE identifier CVE-2013-0155.
Versions Affected: 3.x series Not affected: 2.x series Fixed Versions: 3.2.11, 3.1.10, 3.0.19
Impact ------
Due to the way Active Record interprets parameters in combination with the way that JSON parameters are parsed, it is possible for an attacker to issue unexpected database queries with "IS NULL" or empty where clauses. This issue does not let an attacker insert arbitrary values into an SQL query, however they can cause the query to check for NULL or eliminate a WHERE clause when most users wouldn't expect it.
For example, a system has password reset with token functionality:
unless params[:token].nil? user = User.findbytoken(params[:token]) user.resetpassword! end
An attacker can craft a request such that params[:token] will return [nil]. The [nil] value will bypass the test for nil, but will still add an "IN ('xyz', NULL)" clause to the SQL query.
Similarly, an attacker can craft a request such that params[:token] will return an empty hash. An empty hash will eliminate the WHERE clause of the query, but can bypass the nil? check.
Note that this impacts not only dynamic finders (findby) but also relations (User.where(:name => params[:name])).
All users running an affected release should either upgrade or use one of the work arounds immediately. All users running an affected release should upgrade immediately. Please note, this vulnerability is a variant of CVE-2012-2660, and CVE-2012-2694. Even if you upgraded to address those issues, you must take action again.
If this chance in behavior impacts your application, you can manually decode the original values from the request like so:
ActiveSupport::JSON.decode(request.body)
Releases -------- The FIXED releases are available at the normal locations.
Workarounds ----------- This problem can be mitigated by casting the parameter to a string before passing it to Active Record. For example:
unless params[:token].nil? || params[:token].tos.empty? user = User.findbytoken(params[:token].tos) user.resetpassword! end An attacker can craft a request such that params[:token] will return [nil]. The [nil] value will bypass the test for nil, but will still add an "IN ('xyz', NULL)" clause to the SQL query.
Similarly, an attacker can craft a request such that params[:token] will return an empty hash. An empty hash will eliminate the WHERE clause of the query, but can bypass the nil? check.
Note that this impacts not only dynamic finders (findby) but also relations (User.where(:name => params[:name])).
All users running an affected release should either upgrade or use one of the work arounds immediately. All users running an affected release should upgrade immediately. Please note, this vulnerability is a variant of CVE-2012-2660, and CVE-2012-2694. Even if you upgraded to address those issues, you must take action again.
If this chance in behavior impacts your application, you can manually decode the original values from the request like so:
ActiveSupport::JSON.decode(request.body)
Releases -------- The FIXED releases are available at the normal locations.
Workarounds ----------- This problem can be mitigated by casting the parameter to a string before passing it to Active Record. For example:
unless params[:token].nil? || params[:token].tos.empty? user = User.findbytoken(params[:token].tos) user.resetpassword! end
Note the parameter is still cast to a string before being sent to Active Record. This is because an array with a nil value can still bypass the tos.empty? test:
>> ['xyz', nil].tos => "xyz" >> ['xyz', nil].tos.empty? => false
Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers.
A flaw in the template selection code in Ruby on Rails >=3.0 could allow an attacker to render a view they should not have access to [1]. This is corrected in 3.0.10 and 3.1.0rc6, patches are available in the advisory [1] and in git [2].
[1] http://groups.google.com/group/rubyonrails-security/browsethread/thread/3420ac71aed312d6 [2] https://github.com/rails/rails/commit/5f94b93279f6d0682fafb237c301302c107a9552
Directory traversal vulnerability in actionpack/lib/actiondispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when servestaticassets is enabled, allows remote attackers to determine the existence of files outside the application root via vectors involving a \ (backslash) character, a similar issue to CVE-2014-7818.
Cross-site scripting (XSS) vulnerability in the i18n translations helper method in Ruby on Rails 3.0.x before 3.0.11 and 3.1.x before 3.1.2, and the railsxss plugin in Ruby on Rails 2.3.x, allows remote attackers to inject arbitrary web script or HTML via vectors related to a translations string whose name ends with an "html" substring.
Multiple cross-site scripting (XSS) vulnerabilities in the mailto helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.
The sanitize helper in lib/actioncontroller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded : (colon) characters in URLs, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted scheme name, as demonstrated by including a : sequence.
The cross-site scripting (XSS) prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does not properly handle mutation of safe buffers, which makes it easier for remote attackers to conduct XSS attacks via crafted strings to an application that uses a problematic string method, as demonstrated by the sub method.
An XSS vulnerability in the escaping code used by Ruby on Rails was reported [1] where, using a specially crafted malformed unicode string, an attacker can bypass the escaping code. Due to a bug in the Ruby 1.8 regular expression code, the Ruby on Rails replacement for ERB::Util.h will fail to escape certain malformed unicode strings, which could then be interpreted as HTML by some browsers. This is corrected in upstream 3.0.10, 2.3.13, and 3.1.0rc5 versions and only affects platforms using Ruby 1.8.x (Ruby 1.9.x renders this ineffective).
Patches are available in the advisory [1] and in git [2].
[1] http://groups.google.com/group/rubyonrails-security/browsethread/thread/56bffb5923ab1195 [2] https://github.com/rails/rails/commit/bfc432574d0b141fd7fe759edfe9b6771dd306bd
An XSS vulnerability in the striptags helper in Ruby on Rails was reported [1] where, using specially crafted output, an attacker can successfully inject HTML into the document, which can be used to inject arbitrary javascript into the rendered page.
This is corrected in upstream 3.0.10, 2.3.13, and 3.1.0rc5 versions. Patches are available in the advisory [1] and in git [2].
[1] http://groups.google.com/group/rubyonrails-security/browsethread/thread/2b9130749b74ea12 [2] https://github.com/rails/rails/commit/586a944ddd4d03e66dea1093306147594748037a
Multiple format string vulnerabilities in logsubscriber.rb files in the log subscriber component in Action Mailer in Ruby on Rails 3.x before 3.2.15 allow remote attackers to cause a denial of service via a crafted e-mail address that is improperly handled during construction of a log message.
Cross-site scripting (XSS) vulnerability in json/encoding.rb in Active Support in Ruby on Rails 3.x and 4.1.x before 4.1.11 and 4.2.x before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted Hash that is mishandled during JSON encoding.
Cross-site scripting (XSS) vulnerability in actionpack/lib/actionview/helpers/translationhelper.rb in the internationalization component in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted string that triggers generation of a fallback string by the i18n gem.
Directory traversal vulnerability in actionpack/lib/actiondispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when servestaticassets is enabled, allows remote attackers to determine the existence of files outside the application root via a /..%2F sequence.
The sanitizecss method in lib/actioncontroller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle \n (newline) characters, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences.