SQL injection vulnerability in activerecord/lib/activerecord/connectionadapters/postgresqladapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting.

SQL injection vulnerability in the Active Record component in Ruby on Rails before 2.3.15, 3.0.x before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain findby method calls.

Cross-site scripting (XSS) vulnerability in the i18n translations helper method in Ruby on Rails 3.0.x before 3.0.11 and 3.1.x before 3.1.2, and the railsxss plugin in Ruby on Rails 2.3.x, allows remote attackers to inject arbitrary web script or HTML via vectors related to a translations string whose name ends with an "html" substring.

A flaw in the template selection code in Ruby on Rails >=3.0 could allow an attacker to render a view they should not have access to [1]. This is corrected in 3.0.10 and 3.1.0rc6, patches are available in the advisory [1] and in git [2].

[1] http://groups.google.com/group/rubyonrails-security/browsethread/thread/3420ac71aed312d6 [2] https://github.com/rails/rails/commit/5f94b93279f6d0682fafb237c301302c107a9552

An XSS vulnerability in the escaping code used by Ruby on Rails was reported [1] where, using a specially crafted malformed unicode string, an attacker can bypass the escaping code. Due to a bug in the Ruby 1.8 regular expression code, the Ruby on Rails replacement for ERB::Util.h will fail to escape certain malformed unicode strings, which could then be interpreted as HTML by some browsers. This is corrected in upstream 3.0.10, 2.3.13, and 3.1.0rc5 versions and only affects platforms using Ruby 1.8.x (Ruby 1.9.x renders this ineffective).

Patches are available in the advisory [1] and in git [2].

[1] http://groups.google.com/group/rubyonrails-security/browsethread/thread/56bffb5923ab1195 [2] https://github.com/rails/rails/commit/bfc432574d0b141fd7fe759edfe9b6771dd306bd

An XSS vulnerability in the striptags helper in Ruby on Rails was reported [1] where, using specially crafted output, an attacker can successfully inject HTML into the document, which can be used to inject arbitrary javascript into the rendered page.

This is corrected in upstream 3.0.10, 2.3.13, and 3.1.0rc5 versions. Patches are available in the advisory [1] and in git [2].

[1] http://groups.google.com/group/rubyonrails-security/browsethread/thread/2b9130749b74ea12 [2] https://github.com/rails/rails/commit/586a944ddd4d03e66dea1093306147594748037a

An SQL injection vulnerability in the quotetablename method could allow malicious users to inject arbitrary SQL into a query [1].

This is corrected in upstream 3.0.10, 2.3.13, and 3.1.0rc5 versions. Patches are available in the advisory [1] and in git [2].

[1] http://groups.google.com/group/rubyonrails-security/browsethread/thread/6a1e473744bc389b [2] https://github.com/rails/rails/commit/8a39f411dc3c806422785b1f4d5c7c9d58e4bf85

Cross-site scripting (XSS) vulnerability in actionpack/lib/actionview/helpers/translationhelper.rb in the internationalization component in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted string that triggers generation of a fallback string by the i18n gem.

Symbol DoS vulnerability in Active Record

There is a symbol DoS vulnerability in Active Record. This vulnerability has been assigned the CVE identifier CVE-2013-1854.

Versions Affected: 3.2.x, 3.1.x, 2.3.x Not affected: 3.0.x Fixed Versions: 3.2.13, 3.1.12

Impact ------ When a hash is provided as the find value for a query, the keys of the hash may be converted to symbols. In this example,

User.where(:name => { 'foo' => 'bar' })

the string 'foo' will be converted to a symbol. Impacted code will look something like this:

User.where(:name => params[:name])

Carefully crafted requests can coerce params[:name] to return a hash, and the keys to that hash may be converted to symbols.

All users running an affected release should either upgrade or use one of the work arounds immediately.

Releases -------- The 3.2.13 and 3.1.12 releases are available at the normal locations.

Workarounds ----------- To work around this problem, change code that looks like this:

User.where(:name => params[:name])

to code like this:

User.where(:name => params[:name].tos)

Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

3-2-attributesymbols.patch - Patch for 3.2 series 3-1-attributesymbols.patch - Patch for 3.1 series 2-3-attributesymbols.patch - Patch for 2.3 series

Please note that only the 3.1.x and 3.2.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

Credits -------

Thanks to Ben Murphy for reporting this!

The ActiveSupport::XmlMiniJDOM backend in lib/activesupport/xmlmini/jdom.rb in the Active Support component in Ruby on Rails 3.0.x and 3.1.x before 3.1.12 and 3.2.x before 3.2.13, when JRuby is used, does not properly restrict the capabilities of the XML parser, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving (1) an external DTD or (2) an external entity declaration in conjunction with an entity reference.

The sanitize helper in lib/actioncontroller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded : (colon) characters in URLs, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted scheme name, as demonstrated by including a : sequence.

The sanitizecss method in lib/actioncontroller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle \n (newline) characters, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences.

ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the attrprotected protection mechanism and modify protected model attributes via a crafted request.

Directory traversal vulnerability in actionpack/lib/actiondispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when servestaticassets is enabled, allows remote attackers to determine the existence of files outside the application root via a /..%2F sequence.

Directory traversal vulnerability in actionpack/lib/actiondispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when servestaticassets is enabled, allows remote attackers to determine the existence of files outside the application root via vectors involving a \ (backslash) character, a similar issue to CVE-2014-7818.

Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers.