Rafael Mendonça França reports: There is a vulnerability in the create_with method in Active Record. This vulnerability has been assigned the CVE identifier CVE-2014-3514. Versions Affected: 4.0.0 and All Later Versions. Not affected: Versions earlier than 4.0.0 Fixed Versions: 4.0.9 4.1.5 Impact ------ The create_with functionality in Active Record was implemented incorrectly and completely bypasses the strong parameters protection. Applications which pass user-controlled values to create_with could allow attackers to set arbitrary attributes on models. All users running an affected release should either upgrade or use one of the workarounds immediately. Releases -------- The 4.0.9 and 4.1.5 releases are available at the normal locations. Workarounds ----------- To avoid this vulnerability you will have to either remove all calls to create_with, or carefully audit your codebase to ensure it sanitizes the input first. For example you should replace code like this: user.blog_posts.create_with(params[:blog_post]).create with either: user.blog_posts.create(params[:blog_post]) or: user.blog_posts.create_with(params[:blog_post].permit(:title, :body, :etc)).create Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset. * 4-1-create_with.patch - Patch for 4.1 series * 4-0-create_with.patch - Patch for 4.0 series Please note that only the 4.0.x and 4.1.x series receive regular security updates at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for earlier releases. Credits ------- Thanks to Stephen Touset of Square for reporting the vulnerability to us, and to Jeff Jarmoc of Matasano and Charlie Somerville of GitHub for helping verify the patches and advisories.
Created attachment 928054 [details] 4-0-create_with.patch
Created attachment 928055 [details] 4-1-create_with.patch
Upgraded severity to high as this could allow authentication bypass and privilege escalation.
Upstream advisory: https://groups.google.com/forum/#!topic/rubyonrails-security/M4chq5Sb540 Announcement of fixed versions 4.0.9 and 4.1.5: http://weblog.rubyonrails.org/2014/8/18/Rails_4_0_9_and_4_1_5_have_been_released/ Upstream commits (4.0 and 4.1 branches): https://github.com/rails/rails/commit/d4d0018 https://github.com/rails/rails/commit/9456990
Created rubygem-activerecord tracking bugs for this issue: Affects: fedora-20 [bug 1133622]
IssueDescription: It was discovered that Active Record's create_with method failed to properly check attributes passed to it. A remote attacker could possibly use this flaw to bypass the strong parameter protection and modify arbitrary model attributes via mass assignment if an application using Active Record called create_with with untrusted values.
This issue has been addressed in following products: Red Hat Software Collections 1 for Red Hat Enterprise Linux 6 Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.4 EUS Red Hat Software Collections 1 for Red Hat Enterprise Linux 7 Via RHSA-2014:1102 https://rhn.redhat.com/errata/RHSA-2014-1102.html
rubygem-activerecord-4.0.0-5.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.