Bug 889649 (CVE-2012-5664, CVE-2012-6496)

Summary: CVE-2012-6496 rubygem-activerecord: find_by_* SQL Injection
Product: [Other] Security Response Reporter: Kurt Seifried <kseifried>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: bkabrda, bkearney, bleanhar, cpelland, jialiu, jrusnack, katello-bugs, katello-internal, kseifried, lmeyer, mastahnke, mfisher, mmccune, mmcgrath, mmorsi, morazi, mtasaka, sseago, vanmeeuwen+fedora, vondruch
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=moderate,public=20121221,reported=20121221,source=internet,cvss2=6.4/AV:N/AC:L/Au:N/C:N/I:P/A:P,cloudformscommon-1/rubygem-activerecord=wontfix,sam-1/rubygem-activerecord=affected,openshift-enterprise-1/ruby193-rubygem-activerecord=affected,openshift-enterprise-1/ruby-rubygem-activerecord=affected,openshift-1/ruby193-rubygem-activerecord=affected,openshift-1/ruby-rubygem-activerecord=affected,fedora-all/rubygem-activerecord=affected,epel-5/rubygem-activerecord=affected,cwe=CWE-89
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-06-24 19:05:03 EDT Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Bug Depends On: 891468, 891469, 891470, 891471, 891472, 891473, 893771, 995682    
Bug Blocks: 872346, 889650, 892883    
Attachments:
Description Flags
CVE-2012-5664-2-3-dynamic_finder_injection.patch
none
CVE-2012-5664-3-0-dynamic_finder_injection.patch
none
CVE-2012-5664-3-1-dynamic_finder_injection.patch
none
CVE-2012-5664-3-2-dynamic_finder_injection.patch none

Description Kurt Seifried 2012-12-22 02:43:27 EST
This issue was found on the Phenoelit Blog:

An authlogic cookie usually uses a database stored token to identify the user. The relevant parts of the session cookie are:

    user_credentials_id - a numeric value which is used with "User.find_by_id()"
    user_credentials - a radom string which will be compared with the database field "persistence_token" in the Users table

Due to the way the RoR "find_by_*" methods are defined the following SQL injection a-like issue arises:

> User.find_by_id({:select =>"* from users limit 1 --"})
  User Load (0.5ms)  SELECT * from users limit 1 -- FROM "users" WHERE "users"."id" IS NULL LIMIT 1
 => #<User id: 1, [... all the fun stuff]

By knowing this behaviour we can now easily circumvent the authlogic protection with the knowledge of the "secret_token".
The following cookie would give you access to an authlogic protected application:

{ 
  "session_id" => "41414141", 
  "user_credentials"=>"Phenoelit",
  "user_credentials_id"=>{ 
    :select=> " *,\"Phenoelit\" as persistence_token from Users -- "
  }
}

Last man standing would then be devise/warden, which works similar to authlogic but is not exploitable in that way described above.

External references:

http://phenoelit.org/blog/archives/2012/12/21/let_me_github_that_for_you/index.html
Comment 2 Kurt Seifried 2013-01-02 22:26:00 EST
Aaron Patterson reports:

https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/DCNTNp_qjFM

SQL Injection Vulnerability in Ruby on Rails

There is a SQL injection vulnerability in Active Record in ALL versions. This vulnerability has been assigned the CVE identifier CVE-2012-5664.

Versions Affected:  All.
Not affected:       NONE.
Fixed Versions:     3.2.10, 3.1.9, 3.0.18

Impact
------
Due to the way dynamic finders in Active Record extract options from method parameters, a method parameter can mistakenly be used as a scope.  Carefully crafted requests can use the scope to inject arbitrary SQL.

All users running an affected release should either upgrade or use one of the work arounds immediately.

Impacted code passes user provided data to a dynamic finder like this:

  Post.find_by_id(params[:id])

Releases
--------
The  3.2.10, 3.1.9 & 3.0.18 releases are available at the normal locations.

Workarounds
-----------
The issue can be mitigated by explicitly converting the parameter to an expected value.  For example, change this:

  Post.find_by_id(params[:id])

to this:

  Post.find_by_id(params[:id].to_s)
Comment 3 Kurt Seifried 2013-01-02 22:28:24 EST
Created rubygem-rails tracking bugs for this issue

Affects: epel-5 [bug 891468]
Comment 4 Kurt Seifried 2013-01-02 22:29:59 EST
Created rubygem-rails tracking bugs for this issue

Affects: fedora-all [bug 891469]
Comment 9 Mamoru TASAKA 2013-01-03 02:21:25 EST
Patches available:
http://seclists.org/oss-sec/2013/q1/3
Comment 10 Kurt Seifried 2013-01-03 15:24:16 EST
Created attachment 672189 [details]
CVE-2012-5664-2-3-dynamic_finder_injection.patch
Comment 11 Kurt Seifried 2013-01-03 15:24:34 EST
Created attachment 672190 [details]
CVE-2012-5664-3-0-dynamic_finder_injection.patch
Comment 12 Kurt Seifried 2013-01-03 15:24:52 EST
Created attachment 672191 [details]
CVE-2012-5664-3-1-dynamic_finder_injection.patch
Comment 13 Kurt Seifried 2013-01-03 15:25:08 EST
Created attachment 672192 [details]
CVE-2012-5664-3-2-dynamic_finder_injection.patch
Comment 14 Vít Ondruch 2013-01-03 15:33:56 EST
This is nice explanation of how to exploit this vulnerability: http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-hold-your-horses-here-are-the-facts/
Comment 15 Vincent Danen 2013-01-03 21:29:45 EST
This has been split into two CVEs:

CVE-2012-6496 (SQL injection)
CVE-2012-6497 (Authlogic unsafe find_by_id method calls)

CVE-2012-5664 has been REJECTED, as per:

http://openwall.com/lists/oss-security/2013/01/03/12


Common Vulnerabilities and Exposures assigned an identifier CVE-2012-6496 to
the following vulnerability:

Name: CVE-2012-6496
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6496
Assigned: 20130103
Reference: https://groups.google.com/group/rubyonrails-security/msg/23daa048baf28b64?dmode=source&output=gplain
Reference: http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-hold-your-horses-here-are-the-facts/
Reference: https://bugzilla.redhat.com/show_bug.cgi?id=889649

SQL injection vulnerability in the Active Record component in Ruby on
Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10
allows remote attackers to execute arbitrary SQL commands via a
crafted request that leverages incorrect behavior of dynamic finders
in applications that can use unexpected data types in certain find_by_
method calls.
Comment 16 Vincent Danen 2013-01-03 21:39:21 EST
See bug #891794 for CVE-2012-6497.
Comment 17 errata-xmlrpc 2013-01-10 15:42:40 EST
This issue has been addressed in following products:

  Red Hat Subscription Asset Manager 1.1

Via RHSA-2013:0154 https://rhn.redhat.com/errata/RHSA-2013-0154.html
Comment 18 errata-xmlrpc 2013-01-10 17:41:34 EST
This issue has been addressed in following products:

  CloudForms for RHEL 6

Via RHSA-2013:0155 https://rhn.redhat.com/errata/RHSA-2013-0155.html
Comment 19 Fedora Update System 2013-01-14 21:22:22 EST
rubygem-activerecord-3.0.10-4.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 20 Fedora Update System 2013-01-14 21:31:28 EST
rubygem-activerecord-3.0.11-4.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 21 Fedora Update System 2013-01-14 21:31:51 EST
rubygem-activerecord-3.2.8-2.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 22 errata-xmlrpc 2013-01-31 15:34:02 EST
This issue has been addressed in following products:

  RHEL 6 Version of OpenShift Enterprise

Via RHSA-2013:0220 https://rhn.redhat.com/errata/RHSA-2013-0220.html
Comment 23 errata-xmlrpc 2013-02-21 14:21:07 EST
This issue has been addressed in following products:

  Red Hat Subscription Asset Manager 1.2

Via RHSA-2013:0544 https://rhn.redhat.com/errata/RHSA-2013-0544.html
Comment 24 Kurt Seifried 2013-07-26 02:22:23 EDT
The Red Hat Security Response Team has rated this issue as having moderate security impact in CloudForms 1.1. This issue is not currently planned to be addressed in future updates.
Comment 26 Kurt Seifried 2015-08-20 11:19:38 EDT
this was closed:errata because we released errata to fix it.