Vulnerability CVE-2013-3221
Published: 2013-04-21   Modified: 2013-04-22

Description:
The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attacks against Ruby on Rails applications via a crafted value, as demonstrated by unintended interaction between the "typed XML" feature and a MySQL database.

See advisories in our WLB2 database:
Topic
Author
Date
Med.
Microsoft SQL Server and IBM DB2 data-type injection attacks
joernchen
24.04.2013

Type:

CWE-20

 (Improper Input Validation)

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.4/10
4.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
None
Affected software
Rubyonrails -> Ruby on rails 
Rubyonrails -> Rails 

 References:
http://openwall.com/lists/oss-security/2013/02/06/7
http://openwall.com/lists/oss-security/2013/04/24/7
http://pl.reddit.com/r/netsec/comments/17yajp/mysql_madness_and_rails/
http://www.phenoelit.org/blog/archives/2013/02/index.html
https://gist.github.com/dakull/5442275
https://groups.google.com/group/rubyonrails-security/msg/1f3bc0b88a60c1ce?dmode=source&output=gplain
Copyright 2024, cxsecurity.com

 

Back to Top