====================================================================

                             CERT-Renater

                  Note d'Information No. 2012/VULN246
____________________________________________________________________

DATE                :  04/06/2012

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Ruby on Rails versions prior to
                                   3.2.5, 3.1.5, 3.0.13.

======================================================================
http://groups.google.com/group/rubyonrails-security/browse_thread/thread/7546a238e1962f59
http://groups.google.com/group/rubyonrails-security/browse_thread/thread/f1203e3376acec0f#
______________________________________________________________________

SQL Injection Vulnerability in Ruby on Rails

There is a SQL injection vulnerability in Active Record, version 3.0 and
later. This vulnerability has been assigned the CVE identifier
CVE-2012-2661.

Versions Affected:  3.0.0 and ALL later versions
Not affected:       2.3.14
Fixed Versions:     3.2.4, 3.1.5, 3.0.13

Impact
------
Due to the way Active Record handles nested query parameters, an
attacker can use a specially crafted request to inject some forms of SQL
into your application's SQL queries.

All users running an affected release should upgrade immediately.

Impacted code directly passes request params to the `where` method of an
ActiveRecord class like this:

    Post.where(:id => params[:id]).all

An attacker can make a request that causes `params[:id]` to return a
specially crafted hash that will cause the WHERE clause of the SQL
statement to query an arbitrary table with some value.

Releases
--------
The FIXED releases are available at the normal locations.

Workarounds
-----------
This issue can be mitigated by casting the parameter to an expected
value.  For example, change this:

    Post.where(:id => params[:id]).all

to this:

    Post.where(:id => params[:id].to_s).all

Patches
-------
To aid users who aren't able to upgrade immediately we have provided
patches for the two supported release series.  They are in git-am format
and consist of a single changeset.  We have also provided a patch for
the 3.0 series despite the fact it is unmaintained.

* 3-0-params_sql_injection.patch - Patch for 3.0 series
* 3-1-params_sql_injection.patch - Patch for 3.1 series
* 3-2-params_sql_injection.patch - Patch for 3.2 series

Please note that only the  3.1.x and 3.2.x series are supported at
present.  Users of earlier unsupported releases are advised to upgrade
as soon as possible as we cannot guarantee the continued availability of
security fixes for unsupported releases.

Credits
-------

Thanks to Ben Murphy for reporting the vulnerability to us, and to Chad
Pyne of thoughtbot for helping us verify the fix.

______________________________________________________________________

Unsafe Query Generation Risk in Ruby on Rails

There is a vulnerability when Active Record is used in conjunction
with parameter parsing from Rack via Action Pack. This vulnerability
has been assigned the CVE identifier CVE-2012-2660.

Versions Affected:  ALL versions
Not affected:       NONE
Fixed Versions:     3.2.4, 3.1.5, 3.0.13

Impact
------
Due to the way Active Record interprets parameters in combination with
the way that Rack parses query parameters, it is possible for an
attacker to issue unexpected database queries with "IS NULL" where
clauses.  This issue does *not* let an attacker insert arbitrary values
into an SQL query, however they can cause the query to check for NULL
where most users wouldn't expect it.

For example, a system has password reset with token functionality:

    unless params[:token].nil?
      user = User.find_by_token(params[:token])
      user.reset_password!
    end

An attacker can craft a request such that `params[:token]` will return
`[nil]`.  The `[nil]` value will bypass the test for nil, but will
still add an "IS NULL" clause to the SQL query.

All users running an affected release should either upgrade or use one
of the work arounds immediately.

Releases
--------
The FIXED releases are available at the normal locations.

Workarounds
-----------
This problem can be mitigated by testing for `[nil]`.  For example:

    unless params[:token].nil? || params[:token] == [nil]
      user = User.find_by_token(params[:token])
      user.reset_password!
    end

Another possible workaround is to cast to a known type and test against
that type.  For example:

    unless params[:token].to_s.empty?
      user = User.find_by_token(params[:token])
      user.reset_password!
    end

Patches
-------
To aid users who aren't able to upgrade immediately we have provided
patches for the two supported release series.  They are in git-am
format and consist of a single changeset.

* 3-0-null_param.patch - Patch for 3.0 series
* 3-1-null_param.patch - Patch for 3.1 series
* 3-2-null_param.patch - Patch for 3.2 series

Please note that only the 3.1.x and 3.2.x series are supported at
present.  Users of earlier unsupported releases are advised to upgrade
as soon as possible as we cannot guarantee the continued availability
of security fixes for unsupported releases.

Credits
-------

Thanks to Ben Murphy for reporting the vulnerability to us, and to Chad
Pyne of thoughtbot for helping us verify the fix.

======================================================================

=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
=========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44          +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41          +
+ 75013 Paris           | email: certsvp@renater.fr     +
=========================================================