Security restrictions bypass in Ruby on Rails - CVE-2016-6317

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU8576

Security restrictions bypass in Ruby on Rails - CVE-2016-6317

Published: September 14, 2016 / Updated: September 22, 2017


Vulnerability identifier: #VU8576
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-6317
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to bypass certain security restrictions.

Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values.


Affected software

Ruby on Rails
Fedora
rubygem-activerecord
rubygem-actionpack
rubygem-actioncable
rubygem-actionmailer
rubygem-activejob
rubygem-activemodel
rubygem-activesupport
rubygem-rails
rubygem-actionview
rubygem-railties

How to mitigate CVE-2016-6317

Update to version 4.2.7.1.

rubygem-activerecord - addressed in versions 4.2.3-3.fc23, 4.2.5.2-2.fc24, 5.0.0.1-1.fc25
rubygem-actionpack - addressed in versions 4.2.3-6.fc23, 4.2.5.2-3.fc24, 5.0.0.1-2.fc25
rubygem-actioncable - update to 5.0.0.1-1.fc25
rubygem-actionmailer - update to 5.0.0.1-1.fc25
rubygem-activejob - update to 5.0.0.1-1.fc25
rubygem-activemodel - update to 5.0.0.1-1.fc25
rubygem-activesupport - update to 5.0.0.1-1.fc25
rubygem-rails - update to 5.0.0.1-1.fc25
rubygem-actionview - update to 5.0.0.1-2.fc25
rubygem-railties - update to 5.0.0.1-2.fc25

External References

Related Security Bulletins