CVE-2012-5664: Ruby on Rails: find_by_* SQL Injection

Bug 889649 – CVE-2012-5664 Ruby on Rails: find_by_* SQL Injection

CVE-2012-5664: Ruby on Rails: find_by_* SQL Injection

This issue was found on the Phenoelit Blog: An authlogic cookie usually uses a database stored token to identify the user. The relevant parts of the session cookie are: user_credentials_id - a numeric value which is used with "User.find_by_id()" user_credentials - a radom string which will be compared with the database field "persistence_token" in the Users table Due to the way the RoR "find_by_*" methods are defined the following SQL injection a-like issue arises: > User.find_by_id({:select =>"* from users limit 1 --"}) User Load (0.5ms) SELECT * from users limit 1 -- FROM "users" WHERE "users"."id" IS NULL LIMIT 1 => #<User id: 1, [... all the fun stuff] By knowing this behaviour we can now easily circumvent the authlogic protection with the knowledge of the "secret_token". The following cookie would give you access to an authlogic protected application: { "session_id" =...

Full article: https://bugzilla.redhat.com/show_bug.cgi?id=889649

Tweets

@gnue » 03 Jan '13, 11am
RT @a_yasui: RoRにSQLInjectionがある話。修正版はまだぽい / “Bug 889649 – CVE-2012-5664 Ruby on Rails: find_by_* SQL Injection” [link]
@a_yasui » 03 Jan '13, 11am
RoRにSQLInjectionがある話。修正版はまだぽい / “Bug 889649 – CVE-2012-5664 Ruby on Rails: find_by_* SQL Injection” [link]
@udzura » 03 Jan '13, 1am
ははあ / “Bug 889649 – CVE-2012-5664 Ruby on Rails: find_by_* SQL Injection” [link]
@mikeda » 24 Dec '12, 1pm
RT @matsuu: RoRのfind_by_*にSQLインジェクションの脆弱性があるらしい。カラム名指定がエスケープされてないと。あらまぁ。 / “Bug 889649 – CVE-2012-5664 Ruby on Rails: find_by_* S…” [link]
@netsecured99 » 23 Dec '12, 6pm
RT @WebStartupGroup2012CVE-2012-5664: Ruby on Rails: find_by_* SQL Injection [link] #news: CVE-2012-5664: Ruby on Rails...
@WebStartupGroup » 23 Dec '12, 6pm
CVE-2012-5664: Ruby on Rails: find_by_* SQL Injection [link] #news
@HackerTheArtist » 23 Dec '12, 6pm
From HN: CVE-2012-5664: Ruby on Rails: find_by_* SQL Injection [link]
@hnycombinator » 23 Dec '12, 6pm
CVE-2012-5664: Ruby on Rails: find_by_* SQL Injection [link]
@capetown_rb » 23 Dec '12, 6pm
CVE-2012-5664: Ruby on Rails: find_by_* SQL Injection [link]
@stevesandersonf » 23 Dec '12, 6pm
CVE-2012-5664: Ruby on Rails: find_by_* SQL Injection [link]
@MoonLightRSS1 » 23 Dec '12, 6pm
CVE-2012-5664: Ruby on Rails: find_by_* SQL Injection [link]
@rhirauac » 23 Dec '12, 6pm
CVE-2012-5664: Ruby on Rails: find_by_* SQL Injection [link]
@nateparm » 23 Dec '12, 6pm
CVE-2012-5664: Ruby on Rails: find_by_* SQL Injection [link]