SQL Injection Affecting activerecord package, versions < 4.0.0, >= 3.3 < 3.2.19
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-ACTIVERECORD-20185
- published 1 Jul 2014
- disclosed 1 Jul 2014
- credit Sean Griffin
How to fix?
Upgrade ActiveRecord to version 3.2.19, 4.0.0 or higher.
Overview
ActiveRecord is the Object-Relational Mapping (ORM) that comes out-of-the-box with Rails. It plays the role of Model in the MVC architecture employed by Rails.
Affected versions of this package are vulnerable to SQL Injection. The issue is due to the PostgreSQL adapter for ActiveRecord not properly sanitizing user-supplied input when quoting bitstring. This may allow a remote attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.
PostgreSQL supports a number of unique data types which are not present in other supported databases. A bug in the SQL quoting code in ActiveRecord can allow an attacker to inject arbitrary SQL using carefully crafted values. Only applications which query against either bitstring or range types are vulnerable. The particular data types affected depend on the version of Rails you're using, but the vulnerable code will look the same. Vulnerable code will take either take the form of:
Model.where(bitstring: params[:some_value])
Model.where(range: params[:from]..params[:to])