logo

Database

Lack of data validation In activerecord

Description

Active Record component in Ruby on Rails has a data-type injection vulnerability The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attacks against Ruby on Rails applications via a crafted value, as demonstrated by unintended interaction between the "typed XML" feature and a MySQL database.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2013-32212. NVD-2013-32213. OSV-DEBIAN-2013-32214. OSV-2013-32215. GCVE-2013-32216. SECURITY-TRACKER-CVE-2013-3221

References

1. https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2013-3221.yml2. https://groups.google.com/group/rubyonrails-security/msg/1f3bc0b88a60c1ce?dmode=source&output=gplain3. https://web.archive.org/web/20130825191249/http://www.phenoelit.org/blog/archives/2013/02/index.html4. http://openwall.com/lists/oss-security/2013/02/06/75. http://openwall.com/lists/oss-security/2013/04/24/76. http://pl.reddit.com/r/netsec/comments/17yajp/mysql_madness_and_rails

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.