CVE-2023-22794
published 2023-02-09CVE-2023-22794: A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments. If malicious user input is passed to either the…
PriorityP351high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
2.15%
80.1th percentile
A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments. If malicious user input is passed to either the `annotate` query method, the `optimizer_hints` query method, or through the QueryLogs interface which automatically adds annotations, it may be sent to the database withinsufficient sanitization and be able to inject SQL outside of the comment.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| activerecord_project | activerecord | >= 6.0.0 < 6.0.6.1 | 6.0.6.1 |
| activerecord_project | activerecord | >= 6.0.0 < 6.0.6.1 | 6.0.6.1 |
| activerecord_project | activerecord | >= 6.1.0 < 6.1.7.1 | 6.1.7.1 |
| activerecord_project | activerecord | >= 6.1.0 < 6.1.7.1 | 6.1.7.1 |
| activerecord_project | activerecord | >= 7.0.0 < 7.0.4.1 | 7.0.4.1 |
| activerecord_project | activerecord | >= 7.0.0 < 7.0.4.1 | 7.0.4.1 |
| debian | rails | < rails 2:6.1.7.3+dfsg-1 (bookworm) | rails 2:6.1.7.3+dfsg-1 (bookworm) |
| https | github.com_rails_rails | — | — |
| rubyonrails | rails | >= 0 < 2:6.0.3.7+dfsg-2+deb11u1 | 2:6.0.3.7+dfsg-2+deb11u1 |
| rubyonrails | rails | >= 0 < 2:6.1.7.3+dfsg-1 | 2:6.1.7.3+dfsg-1 |
| rubyonrails | rails | >= 0 < 2:6.1.7.3+dfsg-1 | 2:6.1.7.3+dfsg-1 |
| rubyonrails | rails | >= 0 < 2:6.1.7.3+dfsg-1 | 2:6.1.7.3+dfsg-1 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
ghsa8.8HIGH
osv8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
rubygem-activerecord: SQL Injection
vendor_redhat·2023-01-20·CVSS 8.8
CVE-2023-22794 [HIGH] CWE-89 rubygem-activerecord: SQL Injection
rubygem-activerecord: SQL Injection
A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments. If malicious user input is passed to either the `annotate` query method, the `optimizer_hints` query method, or through the QueryLogs interface which automatically adds annotations, it may be sent to the database withinsufficient sanitization and be able to inject SQL outside of the comment.
A flaw was found in RubyGem's activerecord gem, which is vulnerable to SQL injection. This flaw allows a remote attacker to send specially-crafted SQL statements to the comments, allowing the attacker to view, add, modify, or delete information in the back-end database.
Debian
CVE-2023-22794: rails - A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the s...
vendor_debian·2023·CVSS 8.8
CVE-2023-22794 [HIGH] CVE-2023-22794: rails - A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the s...
A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments. If malicious user input is passed to either the `annotate` query method, the `optimizer_hints` query method, or through the QueryLogs interface which automatically adds annotations, it may be sent to the database withinsufficient sanitization and be able to inject SQL outside of the comment.
Scope: local
bookworm: resolved (fixed in 2:6.1.7.3+dfsg-1)
bullseye: resolved (fixed in 2:6.0.3.7+dfsg-2+deb11u1)
forky: resolved (fixed in 2:6.1.7.3+dfsg-1)
sid: resolved (fixed in 2:6.1.7.3+dfsg-1)
trixie: resolved (fixed in 2:6.1.7.3+dfsg-1)
OSV
CVE-2023-22794: A vulnerability in ActiveRecord <6
osv·2023-02-09·CVSS 8.8
CVE-2023-22794 [HIGH] CVE-2023-22794: A vulnerability in ActiveRecord <6
A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments. If malicious user input is passed to either the `annotate` query method, the `optimizer_hints` query method, or through the QueryLogs interface which automatically adds annotations, it may be sent to the database withinsufficient sanitization and be able to inject SQL outside of the comment.
OSV
SQL Injection Vulnerability via ActiveRecord comments
osv·2023-01-18·CVSS 8.8
CVE-2023-22794 [HIGH] SQL Injection Vulnerability via ActiveRecord comments
SQL Injection Vulnerability via ActiveRecord comments
There is a possible vulnerability in ActiveRecord related to the sanitization of comments. This vulnerability has been assigned the CVE identifier CVE-2023-22794.
Versions Affected: >= 6.0.0 Not affected: { }
}
]
```
All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases
The FIXED releases are available at the normal locations.
Workarounds
Avoid passing user input to annotate and avoid using QueryLogs configuration which can include user input.
Patches
To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.
6-0-Make-sanitize_as_sql_comment-more-strict.patch
GHSA
SQL Injection Vulnerability via ActiveRecord comments
ghsa·2023-01-18·CVSS 8.8
CVE-2023-22794 [HIGH] CWE-89 SQL Injection Vulnerability via ActiveRecord comments
SQL Injection Vulnerability via ActiveRecord comments
There is a possible vulnerability in ActiveRecord related to the sanitization of comments. This vulnerability has been assigned the CVE identifier CVE-2023-22794.
Versions Affected: >= 6.0.0 Not affected: { }
}
]
```
All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases
The FIXED releases are available at the normal locations.
Workarounds
Avoid passing user input to annotate and avoid using QueryLogs configuration which can include user input.
Patches
To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.
6-0-Make-sanitize_as_sql_comment-more-strict.patch
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://discuss.rubyonrails.org/t/cve-2023-22794-sql-injection-vulnerability-via-activerecord-comments/82117https://security.netapp.com/advisory/ntap-20240202-0008/https://www.debian.org/security/2023/dsa-5372https://discuss.rubyonrails.org/t/cve-2023-22794-sql-injection-vulnerability-via-activerecord-comments/82117https://security.netapp.com/advisory/ntap-20240202-0008/https://www.debian.org/security/2023/dsa-5372
2023-02-09
Published