CVE-2013-0155
published 2013-01-13CVE-2013-0155: Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active…
PriorityP340medium6.4CVSS 2.0
AVNACLAuNCPIPAN
EPSS
8.24%
94.3th percentile
Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660 and CVE-2012-2694.
Affected
84 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| actionpack_project | actionpack | >= 3.0.0 < 3.2.16 | 3.2.16 |
| actionpack_project | actionpack | >= 4.0.0 < 4.0.2 | 4.0.2 |
| activerecord_project | activerecord | >= 3.0.0 < 3.0.19 | 3.0.19 |
| activerecord_project | activerecord | >= 3.1.0 < 3.1.10 | 3.1.10 |
| activerecord_project | activerecord | >= 3.2.0 < 3.2.11 | 3.2.11 |
| activerecord_project | activerecord | >= 4.2.0 < 4.2.7.1 | 4.2.7.1 |
| debian | debian_linux | — | — |
| debian | rails | < rails 2.3.14.1 (bookworm) | rails 2.3.14.1 (bookworm) |
| debian | rails | < rails 2:4.2.7.1-1 (bookworm) | rails 2:4.2.7.1-1 (bookworm) |
| debian | rails | — | — |
| rubyonrails | rails | <= 4.0.1 | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
CVSS provenance
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N
ghsa6.4MEDIUM
osv6.4MEDIUM
vendor_debian6.4MEDIUM
vendor_redhat6.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Moderate severity vulnerability that affects activerecord
osv·2018-08-13·CVSS 6.4
[MEDIUM] Moderate severity vulnerability that affects activerecord
Moderate severity vulnerability that affects activerecord
Withdrawn, accidental duplicate publish.
Active Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660, CVE-2012-2694, and CVE-2013-0155.
GHSA
Moderate severity vulnerability that affects activerecord
ghsa·2018-08-13·CVSS 6.4
[MEDIUM] Moderate severity vulnerability that affects activerecord
Moderate severity vulnerability that affects activerecord
Withdrawn, accidental duplicate publish.
Active Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660, CVE-2012-2694, and CVE-2013-0155.
GHSA
ActiveRecord in Ruby on Rails allows database-query bypass
ghsa·2017-10-24·CVSS 6.4
CVE-2016-6317 [MEDIUM] CWE-284 ActiveRecord in Ruby on Rails allows database-query bypass
ActiveRecord in Ruby on Rails allows database-query bypass
Active Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660, CVE-2012-2694, and CVE-2013-0155.
GHSA
actionpack allows bypass of database-query restrictions
ghsa·2017-10-24·CVSS 6.4
CVE-2013-6417 [MEDIUM] CWE-284 actionpack allows bypass of database-query restrictions
actionpack allows bypass of database-query restrictions
`actionpack/lib/action_dispatch/http/request.rb` in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.
OSV
Active Record allows bypassing of database-query restrictions
osv·2017-10-24·CVSS 6.4
CVE-2013-0155 [MEDIUM] Active Record allows bypassing of database-query restrictions
Active Record allows bypassing of database-query restrictions
Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660 and CVE-2012-2694.
GHSA
Active Record allows bypassing of database-query restrictions
ghsa·2017-10-24·CVSS 6.4
CVE-2013-0155 [MEDIUM] CWE-284 Active Record allows bypassing of database-query restrictions
Active Record allows bypassing of database-query restrictions
Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660 and CVE-2012-2694.
OSV
actionpack allows bypass of database-query restrictions
osv·2017-10-24·CVSS 6.4
CVE-2013-6417 [MEDIUM] actionpack allows bypass of database-query restrictions
actionpack allows bypass of database-query restrictions
`actionpack/lib/action_dispatch/http/request.rb` in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.
OSV
ActiveRecord in Ruby on Rails allows database-query bypass
osv·2017-10-24·CVSS 6.4
CVE-2016-6317 [MEDIUM] ActiveRecord in Ruby on Rails allows database-query bypass
ActiveRecord in Ruby on Rails allows database-query bypass
Active Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660, CVE-2012-2694, and CVE-2013-0155.
OSV
CVE-2016-6317: Action Record in Ruby on Rails 4
osv·2016-09-07·CVSS 6.4
CVE-2016-6317 [MEDIUM] CVE-2016-6317: Action Record in Ruby on Rails 4
Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660, CVE-2012-2694, and CVE-2013-0155.
OSV
CVE-2013-6417: actionpack/lib/action_dispatch/http/request
osv·2013-12-07·CVSS 6.4
CVE-2013-6417 [MEDIUM] CVE-2013-6417: actionpack/lib/action_dispatch/http/request
actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.
OSV
CVE-2013-0155: Ruby on Rails 3
osv·2013-01-13·CVSS 6.4
CVE-2013-0155 [MEDIUM] CVE-2013-0155: Ruby on Rails 3
Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660 and CVE-2012-2694.
Red Hat
rubygem-activerecord: unsafe query generation in Active Record
vendor_redhat·2016-08-11·CVSS 6.4
CVE-2016-6317 [MEDIUM] CWE-20 rubygem-activerecord: unsafe query generation in Active Record
rubygem-activerecord: unsafe query generation in Active Record
Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660, CVE-2012-2694, and CVE-2013-0155.
A flaw was found in the way Active Record handled certain special values in dynamic finders and relations. If a Ruby on Rails application performed JSON parameter parsing, a remote attacker could possibly manipulate search conditions in SQL queries generated by the application.
Package:
Debian
CVE-2016-6317: rails - Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider d...
vendor_debian·2016·CVSS 6.4
CVE-2016-6317 [MEDIUM] CVE-2016-6317: rails - Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider d...
Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660, CVE-2012-2694, and CVE-2013-0155.
Scope: local
bookworm: resolved (fixed in 2:4.2.7.1-1)
bullseye: resolved (fixed in 2:4.2.7.1-1)
forky: resolved (fixed in 2:4.2.7.1-1)
sid: resolved (fixed in 2:4.2.7.1-1)
trixie: resolved (fixed in 2:4.2.7.1-1)
Red Hat
rubygem-actionpack: unsafe query generation risk (incomplete fix for CVE-2013- 0155)
vendor_redhat·2013-12-03·CVSS 6.4
CVE-2013-6417 [MEDIUM] CWE-89 rubygem-actionpack: unsafe query generation risk (incomplete fix for CVE-2013- 0155)
rubygem-actionpack: unsafe query generation risk (incomplete fix for CVE-2013- 0155)
actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.
Package: ruby193-rubygem-actionpack (OpenShift Enterprise 1) - Will not fix
Package: ruby193-rubygem-actionpack (Red Hat OpenStack Platform 4) - Affected
Package: ruby193-r
Red Hat
rubygem-activerecord: Unsafe Query Generation Risk in Ruby on Rails
vendor_redhat·2013-01-08·CVSS 6.4
CVE-2013-0155 [MEDIUM] CWE-89 rubygem-activerecord: Unsafe Query Generation Risk in Ruby on Rails
rubygem-activerecord: Unsafe Query Generation Risk in Ruby on Rails
Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660 and CVE-2012-2694.
Debian
CVE-2013-0155: rails - Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 ...
vendor_debian·2013·CVSS 6.4
CVE-2013-0155 [MEDIUM] CVE-2013-0155: rails - Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 ...
Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660 and CVE-2012-2694.
Scope: local
bookworm: resolved (fixed in 2.3.14.1)
bullseye: resolved (fixed in 2.3.14.1)
forky: resolved (fixed in 2.3.14.1)
sid: resolved (fixed in 2.3.14.1)
trixie: resolved (fixed in 2.3.14.1)
Debian
CVE-2013-6417: rails - actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 an...
vendor_debian·2013·CVSS 6.4
CVE-2013-6417 [MEDIUM] CVE-2013-6417: rails - actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 an...
actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
No detection rules found.
No public exploits indexed.
HackerOne
Unsafe Query Generation (CVE-2012-2660, CVE-2012-2694 and CVE-2013-0155) mitigation bypass
hackerone·2018-02-07·CVSS 6.4
CVE-2012-2660 [MEDIUM] Unsafe Query Generation (CVE-2012-2660, CVE-2012-2694 and CVE-2013-0155) mitigation bypass
Unsafe Query Generation (CVE-2012-2660, CVE-2012-2694 and CVE-2013-0155) mitigation bypass
# Unsafe Query Generation Risk in Active Record
There is a vulnerability when Active Record is used in conjunction with JSON
parameter parsing. This vulnerability has been assigned the CVE identifier
CVE-2016-6317. This vulnerability is similar to CVE-2012-2660, CVE-2012-2694
and CVE-2013-0155.
Versions Affected: >= 4.2.0
Not affected: = 5.0.0
Fixed Versions: 4.2.7.1
Impact
Due to the way Active Record interprets parameters in combination with the way that JSON parameters are parsed, it is possible for an attacker to issue unexpected database queries with "IS NULL" or empty where clauses. This issue does *not* let an attacker insert arbitrary values into an SQL query, however they can cause the
Bugzilla
CVE-2013-6417 rubygem-actionpack: unsafe query generation risk (incomplete fix for CVE-2013- 0155)
bugzilla·2013-12-01·CVSS 6.4
CVE-2013-6417 [MEDIUM] CVE-2013-6417 rubygem-actionpack: unsafe query generation risk (incomplete fix for CVE-2013- 0155)
CVE-2013-6417 rubygem-actionpack: unsafe query generation risk (incomplete fix for CVE-2013- 0155)
Michael Koziarski reports:
Incomplete fix to CVE-2013-0155 (Unsafe Query Generation Risk)
The prior fix to CVE-2013-0155 was incomplete and the use of common 3rd party libraries can accidentally circumvent the protection. This vulnerability has been assigned the CVE identifier CVE-2013-6417.
Versions Affected: All.
Not affected: None
Fixed Versions: 4.0.2 & 3.2.16
Impact
Due to the way that Rack::Request and Rails::Request interact, it is possible for a 3rd party or custom rack middleware to parse the parameters insecurely and store them in the same key that Rails uses for its own parameters. In the event that happens the application will receive unsafe parameters and could be vulnerable
Bugzilla
CVE-2013-0155 CVE-2013-0156 rubygem-actionpack various flaws [fedora-all]
bugzilla·2013-01-09·CVSS 6.4
CVE-2013-0155 [MEDIUM] CVE-2013-0155 CVE-2013-0156 rubygem-actionpack various flaws [fedora-all]
CVE-2013-0155 CVE-2013-0156 rubygem-actionpack various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
Please note: this issue affects
Bugzilla
CVE-2013-0155 rubygem-activerecord: Unsafe Query Generation Risk in Ruby on Rails
bugzilla·2013-01-08·CVSS 6.4
CVE-2013-0155 [MEDIUM] CVE-2013-0155 rubygem-activerecord: Unsafe Query Generation Risk in Ruby on Rails
CVE-2013-0155 rubygem-activerecord: Unsafe Query Generation Risk in Ruby on Rails
Damien Mathieu ([email protected]) reports:
Unsafe Query Generation Risk in Ruby on Rails
There is a vulnerability when Active Record is used in conjunction with JSON
parameter parsing. This vulnerability has been assigned the CVE identifier
CVE-2013-0155.
Versions Affected: 3.x series
Not affected: 2.x series
Fixed Versions: 3.2.11, 3.1.10, 3.0.19
Impact
Due to the way Active Record interprets parameters in combination with the way
that JSON parameters are parsed, it is possible for an attacker to issue
unexpected database queries with "IS NULL" or empty where clauses. This issue
does *not* let an attacker insert arbitrary values into an SQL query, however
they can cause the query to check for NULL or el
http://ics-cert.us-cert.gov/advisories/ICSA-13-036-01Ahttp://lists.apple.com/archives/security-announce/2013/Jun/msg00000.htmlhttp://lists.opensuse.org/opensuse-updates/2013-12/msg00079.htmlhttp://lists.opensuse.org/opensuse-updates/2013-12/msg00081.htmlhttp://lists.opensuse.org/opensuse-updates/2013-12/msg00082.htmlhttp://lists.opensuse.org/opensuse-updates/2014-01/msg00003.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0154.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0155.htmlhttp://support.apple.com/kb/HT5784http://www.debian.org/security/2013/dsa-2609https://groups.google.com/group/rubyonrails-security/msg/bc6f13dafe130ee9?dmode=source&output=gplainhttps://puppet.com/security/cve/cve-2013-0155http://ics-cert.us-cert.gov/advisories/ICSA-13-036-01Ahttp://lists.apple.com/archives/security-announce/2013/Jun/msg00000.htmlhttp://lists.opensuse.org/opensuse-updates/2013-12/msg00079.htmlhttp://lists.opensuse.org/opensuse-updates/2013-12/msg00081.htmlhttp://lists.opensuse.org/opensuse-updates/2013-12/msg00082.htmlhttp://lists.opensuse.org/opensuse-updates/2014-01/msg00003.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0154.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0155.htmlhttp://support.apple.com/kb/HT5784http://www.debian.org/security/2013/dsa-2609https://groups.google.com/group/rubyonrails-security/msg/bc6f13dafe130ee9?dmode=source&output=gplainhttps://puppet.com/security/cve/cve-2013-0155
2013-01-13
Published