Re:SQL Injection Vulnerability in Ruby on Rails; affects all...
by numbsafari on Wednesday January 02, 2013 @10:27PM
(#5000903)
I've been going through the code for ActiveRecord and now AuthLogic. I'm admittedly not well versed in Ruby.
However from the description of the vulnerability found at [1], it would appear as though the cookie value can be set to a Ruby string value that is then parsed by server to produce a Ruby Hash value (rather than the AuthLogic plugin's assumed string value).
Is the eval() of the cookie value done by Rails or is it done by AuthLogic? Is that a potential security vulnerability in itself?
However from the description of the vulnerability found at [1], it would appear as though the cookie value can be set to a Ruby string value that is then parsed by server to produce a Ruby Hash value (rather than the AuthLogic plugin's assumed string value).
Is the eval() of the cookie value done by Rails or is it done by AuthLogic? Is that a potential security vulnerability in itself?
[1]http://phenoelit.org/blog/archives/2012/12/21/let_me_github_...
edit: forgot the URL
edit2: nvm ... apparently it's using the Ruby Marshal API, not an eval()-type call.
http://stackoverflow.com/a/2241740