|
| 1 | +--- |
| 2 | +layout: advisory |
| 3 | +title: ! 'CVE-2016-6317 (activerecord): Unsafe Query Generation Risk in Active Record' |
| 4 | +comments: false |
| 5 | +categories: |
| 6 | +- activerecord |
| 7 | +- rails |
| 8 | +advisory: |
| 9 | + gem: activerecord |
| 10 | + framework: rails |
| 11 | + cve: 2016-6317 |
| 12 | + date: 2016-08-11 |
| 13 | + url: https://groups.google.com/forum/#!topic/rubyonrails-security/rgO20zYW33s |
| 14 | + title: Unsafe Query Generation Risk in Active Record |
| 15 | + description: ! "There is a vulnerability when Active Record is used in conjunction |
| 16 | + with JSON\nparameter parsing. This vulnerability is similar to CVE-2012-2660,\nCVE-2012-2694 |
| 17 | + and CVE-2013-0155.\n\nImpact\n------\n\nDue to the way Active Record interprets |
| 18 | + parameters in combination with the way\nthat JSON parameters are parsed, it is |
| 19 | + possible for an attacker to issue\nunexpected database queries with \"IS NULL\" |
| 20 | + or empty where clauses. This issue\ndoes *not* let an attacker insert arbitrary |
| 21 | + values into an SQL query, however\nthey can cause the query to check for NULL |
| 22 | + or eliminate a WHERE clause when\nmost users wouldn't expect it.\n\nFor example, |
| 23 | + a system has password reset with token functionality:\n\n```ruby\n unless params[:token].nil?\n |
| 24 | + \ user = User.find_by_token(params[:token])\n user.reset_password!\n |
| 25 | + \ end\n```\n\nAn attacker can craft a request such that `params[:token]` will |
| 26 | + return\n`[nil]`. The `[nil]` value will bypass the test for nil, but will still |
| 27 | + add\nan \"IN ('xyz', NULL)\" clause to the SQL query.\n\nSimilarly, an attacker |
| 28 | + can craft a request such that `params[:token]` will\nreturn an empty hash. An |
| 29 | + empty hash will eliminate the WHERE clause of the\nquery, but can bypass the `nil?` |
| 30 | + check.\n\nNote that this impacts not only dynamic finders (`find_by_*`) but also\nrelations |
| 31 | + (`User.where(:name => params[:name])`).\n\nAll users running an affected release |
| 32 | + should either upgrade or use one of the\nwork arounds immediately. All users running |
| 33 | + an affected release should upgrade\nimmediately. Please note, this vulnerability |
| 34 | + is a variant of CVE-2012-2660,\nCVE-2012-2694, and CVE-2013-0155. Even if you |
| 35 | + upgraded to address those\nissues, you must take action again.\n\nIf this chance |
| 36 | + in behavior impacts your application, you can manually decode\nthe original values |
| 37 | + from the request like so:\n\n `ActiveSupport::JSON.decode(request.body)`\n\nWorkarounds\n-----------\nThis |
| 38 | + problem can be mitigated by casting the parameter to a string before\npassing |
| 39 | + it to Active Record. For example:\n\n ```ruby\n unless params[:token].nil? |
| 40 | + || params[:token].to_s.empty?\n user = User.find_by_token(params[:token].to_s)\n |
| 41 | + \ user.reset_password!\n end\n ```\n" |
| 42 | + unaffected_versions: |
| 43 | + - < 4.2.0 |
| 44 | + - ! '>= 5.0.0' |
| 45 | + patched_versions: |
| 46 | + - ~> 4.2.7.1 |
| 47 | +--- |
0 commit comments