Ruby on Rails ActiveRecord Class Rack Query Parameter Parsing SQL Query Arbitrary IS NULL Clause Injection

Metadata

medium
6.4
activerecord
CVE-2012-2660
osvdb.org
2012-05-31
2017-06-16 18:59
CVE-2012-2660 ruby-activerecord-3.2
CVE-2012-2660
2017-04-01 19:10
2017-01-05 20:15

Description

Ruby on Rails contains a flaw related to the way ActiveRecord handles
parameters in conjunction with the way Rack parses query parameters.
This issue may allow an attacker to inject arbitrary 'IS NULL' clauses in
to application SQL queries. This may also allow an attacker to have the
SQL query check for NULL in arbitrary places.

Am I vulnerable?

The constraints below list the versions that this vulnerability is patched in, and versions that are unaffected. If a patch is ready but unrealeased, then it is pending.

Or, you can just let us figure it out for you! Appcanary continously monitor your installed packages, and tell you if any of them are vulnerable.

Sign up for monitoring

Affected package information

Package Patched in Unaffected in
activerecord ~> 3.0.13,~> 3.1.5,>= 3.2.4 None