File Content Disclosure in Action View

Impact ------ There is a possible file content disclosure vulnerability in Action View. Specially crafted accept headers in combination with calls to render file: can cause arbitrary files on the target server to be rendered, disclosing the file contents.

The impact is limited to calls to render which render file contents without a specified accept format. Impacted code in a controller looks something like this:

ruby class UserController < ApplicationController def index render file: "#{Rails.root}/some/file" end end

Rendering templates as opposed to files is not impacted by this vulnerability.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases -------- The 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, and 4.2.11.1 releases are available at the normal locations.

Workarounds ----------- This vulnerability can be mitigated by specifying a format for file rendering, like this:

ruby class UserController < ApplicationController def index render file: "#{Rails.root}/some/file", formats: [:html] end end

In summary, impacted calls to render look like this:

render file: "#{Rails.root}/some/file"

The vulnerability can be mitigated by changing to this:

render file: "#{Rails.root}/some/file", formats: [:html]

Other calls to render are not impacted.

Alternatively, the following monkey patch can be applied in an initializer:

ruby $ cat config/initializers/formatsfilter.rb frozenstringliteral: true

ActionDispatch::Request.prepend(Module.new do def formats super().select do |format| format.symbol || format.ref == "/" end end end)

Credits ------- Thanks to John Hawthorn <john@hawthorn.email> of GitHub

Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/actionview/helpers/numberhelper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2) negativeformat, or (3) units parameter to the (a) numbertocurrency, (b) numbertopercentage, or (c) numbertohuman helper.

actionpack/lib/actionview/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during use of the :text option to the render method, which allows remote attackers to cause a denial of service (memory consumption) by including these strings in headers.

actionpack/lib/actiondispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.

actionpack/lib/actionview/lookupcontext.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to cause a denial of service (memory consumption) via a header containing an invalid MIME type that leads to excessive caching.

Cross-site scripting (XSS) vulnerability in the numbertocurrency helper in actionpack/lib/actionview/helpers/numberhelper.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the unit parameter.

A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1. Specially crafted cookies, in combination with a specially crafted XFORWARDEDHOST header can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.

actionpack/lib/actiondispatch/http/request.rb in Ruby on Rails before 2.3.16, 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain [nil] values, a related issue to CVE-2012-2694.

tenderlove reports:

DoS Vulnerability in authenticateorrequestwithhttpdigest

There is a DoS vulnerability in Action Pack digest authentication handling in Rails. This vulnerability has been assigned the CVE identifier CVE-2012-3424.

Versions Affected: 3.x. Not affected: 2.3.5 - 2.3.14 Fixed Versions: 3.0.16, 3.1.7, 3.2.7

Impact ------

All users using Digest Authentication support in Rails should upgrade immediately. Impacted code uses any of the withhttpdigest controller helper methods. For example:

class MyController < ApplicationController def index authenticateorrequestwithhttpdigest(REALM) do |uname| # ... end end end

Releases -------- The 3.0.16, 3.1.7 & 3.2.7 releases are available at the normal locations.

Workarounds ----------- There are no feasible workarounds for this issue.

Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

3-0-digestauthdos.patch - Patch for 3.0 series 3-1-digestauthdos.patch - Patch for 3.1 series 3-2-digestauthdos.patch - Patch for 3.2 series

Please note that only the 3.1.x and 3.2.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

Credits ------- Thanks to Charlie Somerville for reporting this issue!

References:

http://weblog.rubyonrails.org/2012/7/26/ann-rails-3-2-7-has-been-released/ https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/vxJjrc15qYM

diff --git a/actionpack/lib/actioncontroller/metal/httpauthentication.rb b/actionpack/lib/actioncontroller/metal/httpauthentication.rb index 9f2f547..fe4ab65 100644 --- a/actionpack/lib/actioncontroller/metal/httpauthentication.rb +++ b/actionpack/lib/actioncontroller/metal/httpauthentication.rb @@ -227,9 +227,9 @@ module ActionController end def decodecredentials(header) - Hash[header.tos.gsub(/^Digest\s+/,'').split(',').map do |pair| + HashWithIndifferentAccess[header.tos.gsub(/^Digest\s+/,'').split(',').map do |pair| key, value = pair.split('=', 2) - [key.strip.tosym, value.tos.gsub(/^"|"$/,'').gsub(/'/, '')] + [key.strip, value.tos.gsub(/^"|"$/,'').delete('\'')] end] end

Cross-site scripting (XSS) vulnerability in activesupport/lib/activesupport/coreext/string/outputsafety.rb in Ruby on Rails before 2.3.16, 3.0.x before , 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a ' (quote) character.

Cross-site scripting (XSS) vulnerability in actionpack/lib/actionview/helpers/sanitizehelper.rb in the striptags helper in Ruby on Rails before 2.3.16, 3.0.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML markup.

Originally, the CVE-2012-2661 identifier has been assigned to the following issue:

A security flaw was found in the way rubygem-activerecord, the ActiveRecord pattern for ORM, performed SQL query generation based on the content of params hash, when nested query paramaters were provided. If a Ruby on Rails application directly passed request params to the 'where' method of an ActiveRecord class, a remote attacker could use this flaw to cause the 'params[:id]' to return a specially-crafted hash, resulting into the WHERE clause of the SQL statement to query an arbitrary table with value of attacker's choice, leading to disclosure of sensitive information. (bug 827363)

Recently (2012-06-12) it has been reported: [1] https://groups.google.com/group/rubyonrails-security/browsethread/thread/9782f44c4540cf59

that there still exists a variant of this attack, which is possible to exploit even when the upstream patch for the original CVE-2012-2661 issue has been applied. More from [1]:

--

Due to the way Active Record handles nested query parameters, an attacker can use a specially crafted request to inject some forms of SQL into your application's SQL queries.

All users running an affected release should upgrade immediately. Please note, this vulnerability is a variant of CVE-2012-2661, even if you upgraded to address that issue, you must take action again.

Impacted code directly passes request params to the where method of an ActiveRecord class like this:

Post.where(:id => params[:id]).all

An attacker can make a request that causes params[:id] to return a specially crafted hash that will cause the WHERE clause of the SQL statement to query an arbitrary table with some value.

--

Proposed upstream patches (see attachments).

actionpack/lib/actiondispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain ['xyz', nil] values, a related issue to CVE-2012-2660.

Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs.

The session fixation protection mechanism in cgiprocess.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookieonly attribute from the DEFAULTSESSIONOPTIONS constant, which effectively causes cookieonly to be applied only to the first instantiation of CgiRequest, which allows remote attackers to conduct session fixation attacks. NOTE: this is due to an incomplete fix for CVE-2007-5380.

Cross-site scripting (XSS) vulnerability in actionpack/lib/actionview/helpers/formtaghelper.rb in Ruby on Rails 3.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via the prompt field to the selecttag helper.

A security flaw was found in the way rubygem-activerecord, the ActiveRecord pattern for ORM, performed SQL query generation based on the content of params hash, when nested query paramaters were provided. If a Ruby on Rails application directly passed request params to the 'where' method of an ActiveRecord class, a remote attacker could use this flaw to cause the 'params[:id]' to return a specially-crafted hash, resulting into the WHERE clause of the SQL statement to query an arbitrary table with value of attacker's choice, leading to disclosure of sensitive information.

Upstream advisory announcement: [1] http://groups.google.com/group/rubyonrails-security/browsethread/thread/7546a238e1962f59

Relevant patches: [2] http://groups.google.com/group/rubyonrails-security/attach/fc2da6c627fc92df/3-0-paramssqlinjection.patch?part=3 (against v3.0 branch) [3] http://groups.google.com/group/rubyonrails-security/attach/fc2da6c627fc92df/3-1-paramssqlinjection.patch?part=4 (against v3.1 branch) [4] http://groups.google.com/group/rubyonrails-security/attach/fc2da6c627fc92df/3-2-paramssqlinjection.patch?part=5 (against v3.2 branch)

A cross-site scripting (XSS) flaw was found in the way the String class, used in Ruby on Rails, performed HTML escaping of SafeBuffer objects, when such objects were manipulated directly via '[]' method or other methods, also returning new instances of SafeBuffer object. By using these methods, such newly returned SafeBuffer instances would be inadvertently marked as HTML safe. If a Ruby on Rails application used SafeBuffer objects this way, a remote attacker could provide a specially-crafted input, which once processed by such SafeBuffer instance would pass the HTML escaping test without further filtering, possibly leading to arbitrary HTML or webscript execution.

References: [1] http://weblog.rubyonrails.org/2012/3/1/ann-rails-3-0-12-has-been-released [2] http://groups.google.com/group/rubyonrails-security/browsethread/thread/edd28f1e3d04e913 [3] https://bugs.gentoo.org/showbug.cgi?id=406547

Proposed upstream patches: [4] http://groups.google.com/group/rubyonrails-security/attach/1c2e01a5e42722c9/3-0-safe-buffer-slice.patch?part=3 (against v3.0 branch) [5] http://groups.google.com/group/rubyonrails-security/attach/1c2e01a5e42722c9/3-1-safe-buffer-slice.patch?part=4 (against v3.1 branch) [6] http://groups.google.com/group/rubyonrails-security/attach/1c2e01a5e42722c9/3-2-safe-buffer-slice.patch?part=5 (against v3.2 branch)

A cross-site scripting (XSS) flaw was found in the way 'select' helper method of the Ruby on Rails performed HTML escaping of 'select' HTML tag options, when the tags were created manually. In this case, the select tag values might end up unescaped. A remote-attacker could provide a specially-crafted input to Ruby on Rails application, using select tags this way, which potentially resulted into arbitrary HTML or webscript execution.

References: [1] http://weblog.rubyonrails.org/2012/3/1/ann-rails-3-0-12-has-been-released [2] http://groups.google.com/group/rubyonrails-security/browsethread/thread/9da0c515a6c4664 [3] https://bugs.gentoo.org/showbug.cgi?id=406547

Proposed upstream patches: [4] http://groups.google.com/group/rubyonrails-security/attach/6fca4f5c47705488/3-0-selectoptions.patch?part=3 (against v3.0 branch) [5] http://groups.google.com/group/rubyonrails-security/attach/6fca4f5c47705488/3-1-selectoptions.patch?part=4 (against v3.1 branch) [6] http://groups.google.com/group/rubyonrails-security/attach/6fca4f5c47705488/3-2-selectoptions.patch?part=5 (against v3.2 branch)

The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attacks against Ruby on Rails applications via a crafted value, as demonstrated by unintended interaction between the "typed XML" feature and a MySQL database.