Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.Test your applications
1 Jul 2014
1 Jul 2014
How to fix?
ActiveRecord to version 3.2.19, 4.0.0 or higher.
ActiveRecord is the Object-Relational Mapping (ORM) that comes out-of-the-box with Rails. It plays the role of Model in the MVC architecture employed by Rails.
Affected versions of this package are vulnerable to SQL Injection. The issue is due to the PostgreSQL adapter for ActiveRecord not properly sanitizing user-supplied input when quoting
bitstring. This may allow a remote attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.
PostgreSQL supports a number of unique data types which are not present in other supported databases. A bug in the SQL quoting code in ActiveRecord can allow an attacker to inject arbitrary SQL using carefully crafted values. Only applications which query against either
range types are vulnerable. The particular data types affected depend on the version of Rails you're using, but the vulnerable code will look the same. Vulnerable code will take either take the form of:
Model.where(bitstring: params[:some_value]) Model.where(range: params[:from]..params[:to])