GHSA-wpw7-wxjm-cw8r

actionpack allows bypass of database-query restrictions

En bref

Publiée: 2017-10-24 18:33 UTC
Mise à jour: 2024-11-29 05:26 UTC
CVE: CVE-2013-6417

Description

`actionpack/lib/action_dispatch/http/request.rb` in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.

Paquets affectés

Paquet	Versions
RubyGems · actionpack	introduced 3.0.0, fixed 3.2.16
RubyGems · actionpack	introduced 4.0.0, fixed 4.0.2

Références

https://nvd.nist.gov/vuln/detail/CVE-2013-6417 ADVISORY
https://github.com/rails/rails PACKAGE
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2013-6417.yml WEB
https://groups.google.com/forum/#!topic/ruby-security-ann/niK4drpSHT4 WEB
https://groups.google.com/forum/message/raw?msg=ruby-security-ann/niK4drpSHT4/g8JW8ZsayRkJ WEB
https://puppet.com/security/cve/cve-2013-6417 WEB
https://web.archive.org/web/20160806051251/https://puppet.com/security/cve/cve-2013-6417 WEB
http://lists.opensuse.org/opensuse-updates/2013-12/msg00079.html WEB
http://lists.opensuse.org/opensuse-updates/2013-12/msg00081.html WEB
http://lists.opensuse.org/opensuse-updates/2013-12/msg00082.html WEB
http://lists.opensuse.org/opensuse-updates/2014-01/msg00003.html WEB
http://rhn.redhat.com/errata/RHSA-2013-1794.html WEB
http://rhn.redhat.com/errata/RHSA-2014-0008.html WEB
http://rhn.redhat.com/errata/RHSA-2014-0469.html WEB
http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released WEB
http://www.debian.org/security/2014/dsa-2888 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database