SQL Injection Affecting activerecord package, versions >=4.1.0, <4.1.3 >=4.0.0, <4.0.7



    Attack Complexity Low

    Threat Intelligence

    EPSS 0.64% (77th percentile)
Expand this section
7.3 high
Expand this section
Red Hat
4.3 medium

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • published 1 Jul 2014
  • disclosed 1 Jul 2014
  • credit Sean Griffin


ActiveRecord is the Object-Relational Mapping (ORM) that comes out-of-the-box with Rails. It plays the role of Model in the MVC architecture employed by Rails.

Ruby on Rails contains a flaw that may allow carrying out an SQL injection attack. The issue is due to the PostgreSQL adapter for ActiveRecord not properly sanitizing user-supplied input when quoting ranges. This may allow a remote attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.


PostgreSQL supports a number of unique data types which are not present in other supported databases. A bug in the SQL quoting code in ActiveRecord can allow an attacker to inject arbitrary SQL using carefully crafted values.

Only applications which query against either bitstring or range types are vulnerable. The particular data types affected depend on the version of Rails you're using, but the vulnerable code will look the same. Vulnerable code will take either take the form of:

  Model.where(bitstring: params[:some_value])
  Model.where(range: params[:from]..params[:to])