Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/actionview/helpers/numberhelper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2) negativeformat, or (3) units parameter to the (a) numbertocurrency, (b) numbertopercentage, or (c) numbertohuman helper.

actionpack/lib/actionview/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during use of the :text option to the render method, which allows remote attackers to cause a denial of service (memory consumption) by including these strings in headers.

actionpack/lib/actionview/lookupcontext.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to cause a denial of service (memory consumption) via a header containing an invalid MIME type that leads to excessive caching.

Cross-site scripting (XSS) vulnerability in the numbertocurrency helper in actionpack/lib/actionview/helpers/numberhelper.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the unit parameter.

actionpack/lib/actiondispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.

The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attacks against Ruby on Rails applications via a crafted value, as demonstrated by unintended interaction between the "typed XML" feature and a MySQL database.

Cross-site scripting (XSS) vulnerability in actionpack/lib/actionview/helpers/sanitizehelper.rb in the striptags helper in Ruby on Rails before 2.3.16, 3.0.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML markup.

Cross-site scripting (XSS) vulnerability in activesupport/lib/activesupport/coreext/string/outputsafety.rb in Ruby on Rails before 2.3.16, 3.0.x before , 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a ' (quote) character.

Cross-site scripting (XSS) vulnerability in actionpack/lib/actionview/helpers/formtaghelper.rb in Ruby on Rails 3.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via the prompt field to the selecttag helper.

tenderlove reports:

DoS Vulnerability in authenticateorrequestwithhttpdigest

There is a DoS vulnerability in Action Pack digest authentication handling in Rails. This vulnerability has been assigned the CVE identifier CVE-2012-3424.

Versions Affected: 3.x. Not affected: 2.3.5 - 2.3.14 Fixed Versions: 3.0.16, 3.1.7, 3.2.7

Impact ------

All users using Digest Authentication support in Rails should upgrade immediately. Impacted code uses any of the withhttpdigest controller helper methods. For example:

class MyController < ApplicationController def index authenticateorrequestwithhttpdigest(REALM) do |uname| # ... end end end

Releases -------- The 3.0.16, 3.1.7 & 3.2.7 releases are available at the normal locations.

Workarounds ----------- There are no feasible workarounds for this issue.

Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

3-0-digestauthdos.patch - Patch for 3.0 series 3-1-digestauthdos.patch - Patch for 3.1 series 3-2-digestauthdos.patch - Patch for 3.2 series

Please note that only the 3.1.x and 3.2.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

Credits ------- Thanks to Charlie Somerville for reporting this issue!

References:

http://weblog.rubyonrails.org/2012/7/26/ann-rails-3-2-7-has-been-released/ https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/vxJjrc15qYM

diff --git a/actionpack/lib/actioncontroller/metal/httpauthentication.rb b/actionpack/lib/actioncontroller/metal/httpauthentication.rb index 9f2f547..fe4ab65 100644 --- a/actionpack/lib/actioncontroller/metal/httpauthentication.rb +++ b/actionpack/lib/actioncontroller/metal/httpauthentication.rb @@ -227,9 +227,9 @@ module ActionController end def decodecredentials(header) - Hash[header.tos.gsub(/^Digest\s+/,'').split(',').map do |pair| + HashWithIndifferentAccess[header.tos.gsub(/^Digest\s+/,'').split(',').map do |pair| key, value = pair.split('=', 2) - [key.strip.tosym, value.tos.gsub(/^"|"$/,'').gsub(/'/, '')] + [key.strip, value.tos.gsub(/^"|"$/,'').delete('\'')] end] end

actionpack/lib/actiondispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain ['xyz', nil] values, a related issue to CVE-2012-2660.

Originally, the CVE-2012-2661 identifier has been assigned to the following issue:

A security flaw was found in the way rubygem-activerecord, the ActiveRecord pattern for ORM, performed SQL query generation based on the content of params hash, when nested query paramaters were provided. If a Ruby on Rails application directly passed request params to the 'where' method of an ActiveRecord class, a remote attacker could use this flaw to cause the 'params[:id]' to return a specially-crafted hash, resulting into the WHERE clause of the SQL statement to query an arbitrary table with value of attacker's choice, leading to disclosure of sensitive information. (bug 827363)

Recently (2012-06-12) it has been reported: [1] https://groups.google.com/group/rubyonrails-security/browsethread/thread/9782f44c4540cf59

that there still exists a variant of this attack, which is possible to exploit even when the upstream patch for the original CVE-2012-2661 issue has been applied. More from [1]:

--

Due to the way Active Record handles nested query parameters, an attacker can use a specially crafted request to inject some forms of SQL into your application's SQL queries.

All users running an affected release should upgrade immediately. Please note, this vulnerability is a variant of CVE-2012-2661, even if you upgraded to address that issue, you must take action again.

Impacted code directly passes request params to the where method of an ActiveRecord class like this:

Post.where(:id => params[:id]).all

An attacker can make a request that causes params[:id] to return a specially crafted hash that will cause the WHERE clause of the SQL statement to query an arbitrary table with some value.

--

Proposed upstream patches (see attachments).

A security flaw was found in the way rubygem-activerecord, the ActiveRecord pattern for ORM, performed SQL query generation based on the content of params hash, when nested query paramaters were provided. If a Ruby on Rails application directly passed request params to the 'where' method of an ActiveRecord class, a remote attacker could use this flaw to cause the 'params[:id]' to return a specially-crafted hash, resulting into the WHERE clause of the SQL statement to query an arbitrary table with value of attacker's choice, leading to disclosure of sensitive information.

Upstream advisory announcement: [1] http://groups.google.com/group/rubyonrails-security/browsethread/thread/7546a238e1962f59

Relevant patches: [2] http://groups.google.com/group/rubyonrails-security/attach/fc2da6c627fc92df/3-0-paramssqlinjection.patch?part=3 (against v3.0 branch) [3] http://groups.google.com/group/rubyonrails-security/attach/fc2da6c627fc92df/3-1-paramssqlinjection.patch?part=4 (against v3.1 branch) [4] http://groups.google.com/group/rubyonrails-security/attach/fc2da6c627fc92df/3-2-paramssqlinjection.patch?part=5 (against v3.2 branch)

actionpack/lib/actiondispatch/http/request.rb in Ruby on Rails before 2.3.16, 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain [nil] values, a related issue to CVE-2012-2694.

A cross-site scripting (XSS) flaw was found in the way 'select' helper method of the Ruby on Rails performed HTML escaping of 'select' HTML tag options, when the tags were created manually. In this case, the select tag values might end up unescaped. A remote-attacker could provide a specially-crafted input to Ruby on Rails application, using select tags this way, which potentially resulted into arbitrary HTML or webscript execution.

References: [1] http://weblog.rubyonrails.org/2012/3/1/ann-rails-3-0-12-has-been-released [2] http://groups.google.com/group/rubyonrails-security/browsethread/thread/9da0c515a6c4664 [3] https://bugs.gentoo.org/showbug.cgi?id=406547

Proposed upstream patches: [4] http://groups.google.com/group/rubyonrails-security/attach/6fca4f5c47705488/3-0-selectoptions.patch?part=3 (against v3.0 branch) [5] http://groups.google.com/group/rubyonrails-security/attach/6fca4f5c47705488/3-1-selectoptions.patch?part=4 (against v3.1 branch) [6] http://groups.google.com/group/rubyonrails-security/attach/6fca4f5c47705488/3-2-selectoptions.patch?part=5 (against v3.2 branch)

A cross-site scripting (XSS) flaw was found in the way the String class, used in Ruby on Rails, performed HTML escaping of SafeBuffer objects, when such objects were manipulated directly via '[]' method or other methods, also returning new instances of SafeBuffer object. By using these methods, such newly returned SafeBuffer instances would be inadvertently marked as HTML safe. If a Ruby on Rails application used SafeBuffer objects this way, a remote attacker could provide a specially-crafted input, which once processed by such SafeBuffer instance would pass the HTML escaping test without further filtering, possibly leading to arbitrary HTML or webscript execution.

References: [1] http://weblog.rubyonrails.org/2012/3/1/ann-rails-3-0-12-has-been-released [2] http://groups.google.com/group/rubyonrails-security/browsethread/thread/edd28f1e3d04e913 [3] https://bugs.gentoo.org/showbug.cgi?id=406547

Proposed upstream patches: [4] http://groups.google.com/group/rubyonrails-security/attach/1c2e01a5e42722c9/3-0-safe-buffer-slice.patch?part=3 (against v3.0 branch) [5] http://groups.google.com/group/rubyonrails-security/attach/1c2e01a5e42722c9/3-1-safe-buffer-slice.patch?part=4 (against v3.1 branch) [6] http://groups.google.com/group/rubyonrails-security/attach/1c2e01a5e42722c9/3-2-safe-buffer-slice.patch?part=5 (against v3.2 branch)

The session fixation protection mechanism in cgiprocess.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookieonly attribute from the DEFAULTSESSIONOPTIONS constant, which effectively causes cookieonly to be applied only to the first instantiation of CgiRequest, which allows remote attackers to conduct session fixation attacks. NOTE: this is due to an incomplete fix for CVE-2007-5380.