CVE-2012-2694 actionpack allows remote attackers to bypass database-query restrictions, perform NULL checks via crafted request
MediumCVSS 4.3
EPSS 3.9%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain "['xyz', nil]" values, a related issue to CVE-2012-2660.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems actionpack(RubyGems) | >= 3.0.13, < 3.0.14 | 3.0.14 |
| rubygems actionpack(RubyGems) | = 3.0.13 | No fix listed |
| rubygems actionpack(RubyGems) | >= 3.1.0, < 3.1.6 | 3.1.6 |
| rubygems actionpack(RubyGems) | = 3.1.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.1.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.1.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.1.rc3 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.2.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.2.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.3 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.4 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.4.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.5 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.5.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | >= 3.2.0, < 3.2.6 | 3.2.6 |
| rubygems actionpack(RubyGems) | = 3.2.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.2.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.3 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.3.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.3.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.4 | No fix listed |
Show 76 more
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems actionpack(RubyGems) | = 3.2.4.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.5 | No fix listed |
| rubyonrails rails | = 3.0.0 | No fix listed |
| rubyonrails rails | = 3.0.0-beta | No fix listed |
| rubyonrails rails | = 3.0.0-beta2 | No fix listed |
| rubyonrails rails | = 3.0.0-beta3 | No fix listed |
| rubyonrails rails | = 3.0.0-beta4 | No fix listed |
| rubyonrails rails | = 3.0.0-rc | No fix listed |
| rubyonrails rails | = 3.0.0-rc2 | No fix listed |
| rubyonrails rails | = 3.0.1 | No fix listed |
| rubyonrails rails | = 3.0.1-pre | No fix listed |
| rubyonrails rails | = 3.0.2 | No fix listed |
| rubyonrails rails | = 3.0.2-pre | No fix listed |
| rubyonrails rails | = 3.0.3 | No fix listed |
| rubyonrails rails | = 3.0.4-rc1 | No fix listed |
| rubyonrails rails | = 3.0.5 | No fix listed |
| rubyonrails rails | = 3.0.5-rc1 | No fix listed |
| rubyonrails rails | = 3.0.6 | No fix listed |
| rubyonrails rails | = 3.0.6-rc1 | No fix listed |
| rubyonrails rails | = 3.0.6-rc2 | No fix listed |
| rubyonrails rails | = 3.0.7 | No fix listed |
| rubyonrails rails | = 3.0.7-rc1 | No fix listed |
| rubyonrails rails | = 3.0.7-rc2 | No fix listed |
| rubyonrails rails | = 3.0.8 | No fix listed |
| rubyonrails rails | = 3.0.8-rc1 | No fix listed |
| rubyonrails rails | = 3.0.8-rc2 | No fix listed |
| rubyonrails rails | = 3.0.8-rc3 | No fix listed |
| rubyonrails rails | = 3.0.8-rc4 | No fix listed |
| rubyonrails rails | = 3.0.9 | No fix listed |
| rubyonrails rails | = 3.0.9-rc1 | No fix listed |
| rubyonrails rails | = 3.0.9-rc2 | No fix listed |
| rubyonrails rails | = 3.0.9-rc3 | No fix listed |
| rubyonrails rails | = 3.0.9-rc4 | No fix listed |
| rubyonrails rails | = 3.0.9-rc5 | No fix listed |
| rubyonrails rails | = 3.0.10 | No fix listed |
| rubyonrails rails | = 3.0.10-rc1 | No fix listed |
| rubyonrails rails | = 3.0.11 | No fix listed |
| rubyonrails rails | = 3.0.12 | No fix listed |
| rubyonrails rails | = 3.0.12-rc1 | No fix listed |
| rubyonrails rails | = 3.0.13-rc1 | No fix listed |
| rubyonrails rails | = 3.1.0 | No fix listed |
| rubyonrails rails | = 3.1.0-beta1 | No fix listed |
| rubyonrails rails | = 3.1.0-rc1 | No fix listed |
| rubyonrails rails | = 3.1.0-rc2 | No fix listed |
| rubyonrails rails | = 3.1.0-rc3 | No fix listed |
| rubyonrails rails | = 3.1.0-rc4 | No fix listed |
| rubyonrails rails | = 3.1.0-rc5 | No fix listed |
| rubyonrails rails | = 3.1.0-rc6 | No fix listed |
| rubyonrails rails | = 3.1.0-rc7 | No fix listed |
| rubyonrails rails | = 3.1.0-rc8 | No fix listed |
| rubyonrails rails | = 3.1.1 | No fix listed |
| rubyonrails rails | = 3.1.1-rc1 | No fix listed |
| rubyonrails rails | = 3.1.1-rc2 | No fix listed |
| rubyonrails rails | = 3.1.1-rc3 | No fix listed |
| rubyonrails rails | = 3.1.2 | No fix listed |
| rubyonrails rails | = 3.1.2-rc1 | No fix listed |
| rubyonrails rails | = 3.1.2-rc2 | No fix listed |
| rubyonrails rails | = 3.1.3 | No fix listed |
| rubyonrails rails | = 3.1.4 | No fix listed |
| rubyonrails rails | = 3.1.4-rc1 | No fix listed |
| rubyonrails rails | = 3.1.5 | No fix listed |
| rubyonrails rails | = 3.1.5-rc1 | No fix listed |
| rubyonrails rails | = 3.2.0 | No fix listed |
| rubyonrails rails | = 3.2.0-rc1 | No fix listed |
| rubyonrails rails | = 3.2.0-rc2 | No fix listed |
| rubyonrails rails | = 3.2.1 | No fix listed |
| rubyonrails rails | = 3.2.2 | No fix listed |
| rubyonrails rails | = 3.2.2-rc1 | No fix listed |
| rubyonrails rails | = 3.2.3 | No fix listed |
| rubyonrails rails | = 3.2.3-rc1 | No fix listed |
| rubyonrails rails | = 3.2.3-rc2 | No fix listed |
| rubyonrails rails | = 3.2.4 | No fix listed |
| rubyonrails rails | = 3.2.4-rc1 | No fix listed |
| rubyonrails rails | = 3.2.5 | No fix listed |
| rubyonrails ruby on rails | <= 3.0.13 | No fix listed |
| rubyonrails ruby on rails | = 3.0.4 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com product
- github.com exploit
- groups.google.com
- [rubyonrails-security] 20120612 Ruby on Rails Unsafe Query Generation Risk in Ruby on Rails (CVE-2012-2694) exploit mailing-list
- openSUSE-SU-2012:0978 vendor-advisory
- SUSE-SU-2012:1012 vendor-advisory
- SUSE-SU-2012:1014 vendor-advisory
- SUSE-SU-2012:1015 vendor-advisory
- openSUSE-SU-2012:1066 vendor-advisory
- RHSA-2013:0154 vendor-advisory
- github.com