SQL Injection Vulnerability in Ruby on Rails; affects all versions

Re:SQL Injection Vulnerability in Ruby on Rails; affects all... by venus on Wednesday January 02, 2013 @08:40PM (#5000596)

The linked pull request described a method for getting unescaped code into the application so the issue with find_by_id might be exploited.

Have you got another way of getting unescaped code into the application such that this issue might be exploited? If so, the core team will be very, very interested to hear from you.

[ Parent | on HN ]

Re:SQL Injection Vulnerability in Ruby on Rails; affects all... by numbsafari on Wednesday January 02, 2013 @10:27PM (#5000903)

I've been going through the code for ActiveRecord and now AuthLogic. I'm admittedly not well versed in Ruby.

However from the description of the vulnerability found at [1], it would appear as though the cookie value can be set to a Ruby string value that is then parsed by server to produce a Ruby Hash value (rather than the AuthLogic plugin's assumed string value).

Is the eval() of the cookie value done by Rails or is it done by AuthLogic? Is that a potential security vulnerability in itself?

[1]http://phenoelit.org/blog/archives/2012/12/21/let_me_github_...

edit: forgot the URL

edit2: nvm ... apparently it's using the Ruby Marshal API, not an eval()-type call.

http://stackoverflow.com/a/2241740

[ Parent | on HN ]