Permissions, Privileges, and Access Controls in Action Mailer - CVE-2013-6417

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.

Affected software

How to mitigate CVE-2013-6417

External References

• http://lists.opensuse.org/opensuse-updates/2013-12/msg00079.html
• http://lists.opensuse.org/opensuse-updates/2013-12/msg00081.html
• http://lists.opensuse.org/opensuse-updates/2013-12/msg00082.html
• http://lists.opensuse.org/opensuse-updates/2014-01/msg00003.html
• http://rhn.redhat.com/errata/RHSA-2013-1794.html
• http://rhn.redhat.com/errata/RHSA-2014-0008.html
• http://rhn.redhat.com/errata/RHSA-2014-0469.html
• http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/
• http://www.debian.org/security/2014/dsa-2888
• https://groups.google.com/forum/message/raw?msg=ruby-security-ann/niK4drpSHT4/g8JW8ZsayRkJ
• https://puppet.com/security/cve/cve-2013-6417

Related Security Bulletins

• Permissions, Privileges, and Access Controls in Rails Action Mailer for Ruby on Rails
• Permissions, Privileges, and Access Controls in ruby-actionmailer (Alpine package)