oss-security - [Ruby on Rails] [CVE-2014-3514] Strong Parameter bypass with create

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAC9YFzd_TOLvMkevM1UXAPU6gM86TqZX3zn+9DHos9+YmFe6qw@mail.gmail.com>
Date: Mon, 18 Aug 2014 14:11:26 -0300
From: Rafael Mendonça França <rafaelmfranca@...il.com>
To: rubyonrails-security@...glegroups.com, oss-security@...ts.openwall.com, 
	ruby-security-ann@...glegroups.com
Subject: [Ruby on Rails] [CVE-2014-3514] Strong Parameter bypass with create_with

There is a vulnerability in the create_with method in Active Record. This
vulnerability has been assigned the CVE identifier CVE-2014-3514.

Versions Affected:  4.0.0 and All Later Versions.
Not affected:       Versions earlier than 4.0.0
Fixed Versions:     4.0.9 4.1.5

Impact
------
The create_with functionality in Active Record was implemented incorrectly
and completely bypasses the strong parameters protection.  Applications
which pass user-controlled values to create_with could allow attackers to
set arbitrary attributes on models.

All users running an affected release should either upgrade or use one of
the workarounds immediately.

Releases
--------
The 4.0.9 and 4.1.5 releases are available at the normal locations.

Workarounds
-----------
To avoid this vulnerability you will have to either remove all calls to
create_with, or carefully audit your codebase to ensure it sanitizes the
input first.  For example you should replace code like this:

  user.blog_posts.create_with(params[:blog_post]).create

with either:

  user.blog_posts.create(params[:blog_post])

or:

  user.blog_posts.create_with(params[:blog_post].permit(:title, :body,
:etc)).create

Patches
-------
To aid users who aren't able to upgrade immediately we have provided
patches for the two supported release series.  They are in git-am format
and consist of a single changeset.

* 4-1-create_with.patch - Patch for 4.1 series
* 4-0-create_with.patch - Patch for 4.0 series

Please note that only the 4.0.x and 4.1.x series receive regular security
updates at present.  Users of earlier unsupported releases are advised to
upgrade as soon as possible as we cannot guarantee the continued
availability of security fixes for earlier releases.

Credits
-------

Thanks to Stephen Touset of Square for reporting the vulnerability to us,
and to Jeff Jarmoc of Matasano and Charlie Somerville of GitHub for helping
verify the patches and advisories.

Rafael Mendonça França
http://twitter.com/rafaelfranca
https://github.com/rafaelfranca

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.