The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitrary code via a crafted request.

Active Storage allowed transformation methods potentially unsafe

Active Storage attempts to prevent the use of potentially unsafe image transformation methods and parameters by default.

The default allowed list contains three methods allow for the circumvention of the safe defaults which enables potential command injection vulnerabilities in cases where arbitrary user supplied input is accepted as valid transformation methods or parameters.

Impact ------ This vulnerability impacts applications that use Active Storage with the imageprocessing processing gem in addition to minimagick as the image processor.

Vulnerable code will look something similar to this: <%= imagetag blob.variant(params[:t] => params[:v]) %>

Where the transformation method or its arguments are untrusted arbitrary input.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Workarounds ----------- Consuming user supplied input for image transformation methods or their parameters is unsupported behavior and should be considered dangerous.

Strict validation of user supplied methods and parameters should be performed as well as having a strong ImageMagick security policy deployed.

Credits -------

Thank you lio346 for reporting this!

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's DiskService#pathfor does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. ../) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

Possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags to allow both select and style elements.Code is only impacted if allowed tags are being overridden.

Reference:

https://hackerone.com/reports/1530898

The activerecord-sessionstore (aka Active Record Session Store) component through 1.1.3 for Ruby on Rails does not use a constant-time approach when delivering information about whether a guessed session ID is valid. Consequently, remote attackers can leverage timing discrepancies to achieve a correct guess in a relatively short amount of time. This is a related issue to CVE-2019-16782.

Ramon de C Valle (rcvalle) reports:

There is a mass assignment vulnerability in the create method of the UsersController controller.

The create method in app/controllers/userscontroller.rb deletes the user-controlled user[admin] parameter from the params hash but saves it to a local variable and assigns it to the newly created user object bypassing the :attrprotected mechanism.

def create admin = params[:user].delete :admin @user = User.new(params[:user]){|u| u.admin = admin } if @user.save @user.roles << Role.findbyname("Anonymous") unless @user.roles.map(&:name).include? "Anonymous" processsuccess else processerror end end

Any non-admin user with permissions to create other (non-admin) users (i.e. with Manager role) can create arbitrary admin users by sending a specially-crafted POST request.

XSS vulnerability in sanitizecss in Action Pack

There is an XSS vulnerability in the sanitizecss method in Action Pack. This vulnerability has been assigned the CVE identifier CVE-2013-1855.

Versions Affected: All. Not affected: None. Fixed Versions: 3.2.13, 3.1.12

Impact ------ Carefully crafted text can bypass the sanitization provided in the sanitizecss method in Action Pack. Impacted code will look like this:

sanitizecss(someuserinput)

All users running an affected release should either upgrade or use one of the work arounds immediately.

Releases -------- The 3.2.13 and 3.1.12 releases are available at the normal locations.

Workarounds ----------- To work around this issue, you can apply the following monkey patch:

module HTML class WhiteListSanitizer # Sanitizes a block of css code. Used by #sanitize when it comes across a style attribute def sanitizecss(style) # disallow urls style = style.tos.gsub(/url\s\(\s[^\s)]+?\s\)\s/, ' ')

# gauntlet if style !~ /\A([:,;#%.\sa-zA-Z0-9!]|\w-\w|\'[\s\w]+\'|\"[\s\w]+\"|\([\d,\s]+\))\z/ || style !~ /\A(\s[-\w]+\s:\s[^:;](;|$)\s)\z/ return '' end

clean = [] style.scan(/([-\w]+)\s:\s([^:;])/) do |prop,val| if allowedcssproperties.include?(prop.downcase) clean << prop + ': ' + val + ';' elsif shorthandcssproperties.include?(prop.split('-')[0].downcase) unless val.split().any? do |keyword| !allowedcsskeywords.include?(keyword) && keyword !~ /\A(#[0-9a-f]+|rgb\(\d+%?,\d%?,?\d%?\)?|\d{0,2}\.?\d{0,2}(cm|em|ex|in|mm|pc|pt|px|%|,|\))?)\z/ end clean << prop + ': ' + val + ';' end end end clean.join(' ') end end end

Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

3-2-csssanitize.patch - Patch for 3.2 series 3-1-csssanitize.patch - Patch for 3.1 series 3-0-csssanitize.patch - Patch for 3.0 series 2-3-csssanitize.patch - Patch for 2.3 series

Please note that only the 3.1.x and 3.2.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

Credits -------

Thanks to Charlie Somerville for reporting this!

Symbol DoS vulnerability in Active Record

There is a symbol DoS vulnerability in Active Record. This vulnerability has been assigned the CVE identifier CVE-2013-1854.

Versions Affected: 3.2.x, 3.1.x, 2.3.x Not affected: 3.0.x Fixed Versions: 3.2.13, 3.1.12

Impact ------ When a hash is provided as the find value for a query, the keys of the hash may be converted to symbols. In this example,

User.where(:name => { 'foo' => 'bar' })

the string 'foo' will be converted to a symbol. Impacted code will look something like this:

User.where(:name => params[:name])

Carefully crafted requests can coerce params[:name] to return a hash, and the keys to that hash may be converted to symbols.

All users running an affected release should either upgrade or use one of the work arounds immediately.

Releases -------- The 3.2.13 and 3.1.12 releases are available at the normal locations.

Workarounds ----------- To work around this problem, change code that looks like this:

User.where(:name => params[:name])

to code like this:

User.where(:name => params[:name].tos)

Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

3-2-attributesymbols.patch - Patch for 3.2 series 3-1-attributesymbols.patch - Patch for 3.1 series 2-3-attributesymbols.patch - Patch for 2.3 series

Please note that only the 3.1.x and 3.2.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

Credits -------

Thanks to Ben Murphy for reporting this!

There is a possible ReDoS vulnerability in the query parameter filtering routines of Action Dispatch. This vulnerability has been assigned the CVE identifier CVE-2024-41128.

Impact ------

Carefully crafted query parameters can cause query parameter filtering to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade or apply the relevant patch immediately.

Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on Ruby 3.2 or greater so is unaffected.

Releases -------- The fixed releases are available at the normal locations.

Workarounds ----------- Users on Ruby 3.2 are unaffected by this issue.

Credits -------

Thanks to scyoon for the report and patches!

A possibility to circumvent protection against cross-site request forgery (CSRF) attacks was found in Ruby on Rails. Quoting upstream security advisory for exact details:

There is a bug in all 2.1.x versions of Ruby on Rails which affects the effectiveness of the CSRF protection given by protectfromforgery.

By design rails does not perform token verification on requests with certain content types not typically generated by browsers. Unfortunately this list also included ‘text/plain’ which can be generated by browsers.

Requests can be crafted which will circumvent the CSRF protection entirely. Rails does not parse the parameters provided with these requests, but that may not be enough to protect your application.

References: ----------- http://www.rorsecurity.info/journal/2008/11/19/circumvent-rails-csrf-protection.html http://weblog.rubyonrails.org/2008/11/18/potential-circumvention-of-csrf-protection-in-rails-2-1

Upstream patch: --------------- http://github.com/rails/rails/commit/099a98e9b7108dae3e0f78b207e0a7dc5913bd1a

CVE Request: ------------ http://www.openwall.com/lists/oss-security/2009/11/28/1

End of life: 4/27/2017, End of support: 6/30/2016, Latest version: 4.2.11.3

End of life: 4/27/2017, End of support: 6/30/2016, Latest version: 4.2.11.3

End of life: 6/1/2022, End of support: 12/15/2021, Latest version: 5.2.8.1

End of life: 6/1/2022, End of support: 12/15/2021, Latest version: 5.2.8.1

End of life: 4/9/2018, End of support: 4/9/2018, Latest version: 5.0.7.2

End of life: 4/9/2018, End of support: 4/9/2018, Latest version: 5.0.7.2

End of life: 10/1/2025, End of support: 10/1/2024, Latest version: 7.1.6

End of life: 10/1/2025, End of support: 10/1/2024, Latest version: 7.1.6

End of life: 10/1/2024, End of support: 12/15/2021, Latest version: 6.1.7.10

End of life: 10/1/2024, End of support: 12/15/2021, Latest version: 6.1.7.10

End of life: 6/1/2023, End of support: 12/15/2021, Latest version: 6.0.6.1

End of life: 6/1/2023, End of support: 12/15/2021, Latest version: 6.0.6.1

End of life: 8/25/2019, End of support: 4/9/2018, Latest version: 5.1.7

End of life: 8/25/2019, End of support: 4/9/2018, Latest version: 5.1.7

End of life: 4/1/2025, End of support: 10/15/2023, Latest version: 7.0.10

End of life: 4/1/2025, End of support: 10/15/2023, Latest version: 7.0.10

End of life: 8/9/2026, End of support: 8/9/2025, Latest version: 7.2.3.2

End of life: 8/9/2026, End of support: 8/9/2025, Latest version: 7.2.3.2

End of life: 11/7/2026, End of support: 5/7/2026, Latest version: 8.0.5.1

End of life: 11/7/2026, End of support: 5/7/2026, Latest version: 8.0.5.1