logo

Database

Improper authorization control for web services In actionpack

Description

actionpack allows bypass of database-query restrictions actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2013-64172. NVD-2013-64173. OSV-2013-64174. GCVE-2013-6417

References

1. https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2013-6417.yml2. https://groups.google.com/forum/#!topic/ruby-security-ann/niK4drpSHT43. https://groups.google.com/forum/message/raw?msg=ruby-security-ann/niK4drpSHT4/g8JW8ZsayRkJ4. https://puppet.com/security/cve/cve-2013-64175. https://web.archive.org/web/20160806051251/https://puppet.com/security/cve/cve-2013-64176. http://lists.opensuse.org/opensuse-updates/2013-12/msg00079.html7. http://lists.opensuse.org/opensuse-updates/2013-12/msg00081.html8. http://lists.opensuse.org/opensuse-updates/2013-12/msg00082.html9. http://lists.opensuse.org/opensuse-updates/2014-01/msg00003.html10. http://rhn.redhat.com/errata/RHSA-2013-1794.html11. http://rhn.redhat.com/errata/RHSA-2014-0008.html12. http://rhn.redhat.com/errata/RHSA-2014-0469.html13. http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released14. http://www.debian.org/security/2014/dsa-2888

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.