Bug 1131240 (CVE-2014-3514) - CVE-2014-3514 rubygem-activerecord: Strong Parameter bypass with create_with
Summary: CVE-2014-3514 rubygem-activerecord: Strong Parameter bypass with create_with
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2014-3514
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1133530 1133531 1133622
Blocks: 1131241
TreeView+ depends on / blocked
 
Reported: 2014-08-18 18:45 UTC by Kurt Seifried
Modified: 2019-09-29 13:20 UTC (History)
53 users (show)

Fixed In Version: rubygem-activerecord 4.0.9, rubygem-activerecord 4.1.5
Doc Type: Bug Fix
Doc Text:
It was discovered that Active Record's create_with method failed to properly check attributes passed to it. A remote attacker could possibly use this flaw to bypass the strong parameter protection and modify arbitrary model attributes via mass assignment if an application using Active Record called create_with with untrusted values.
Clone Of:
Environment:
Last Closed: 2014-08-27 14:47:37 UTC


Attachments (Terms of Use)
4-0-create_with.patch (4.03 KB, patch)
2014-08-18 19:12 UTC, Kurt Seifried
no flags Details | Diff
4-1-create_with.patch (4.04 KB, patch)
2014-08-18 19:12 UTC, Kurt Seifried
no flags Details | Diff


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2014:1102 normal SHIPPED_LIVE Important: ror40-rubygem-activerecord security update 2014-08-27 18:22:04 UTC

Description Kurt Seifried 2014-08-18 18:45:17 UTC
Rafael Mendonça França reports:

There is a vulnerability in the create_with method in Active Record. This
vulnerability has been assigned the CVE identifier CVE-2014-3514.

Versions Affected:  4.0.0 and All Later Versions.
Not affected:       Versions earlier than 4.0.0
Fixed Versions:     4.0.9 4.1.5

Impact
------
The create_with functionality in Active Record was implemented incorrectly
and completely bypasses the strong parameters protection.  Applications
which pass user-controlled values to create_with could allow attackers to
set arbitrary attributes on models.

All users running an affected release should either upgrade or use one of
the workarounds immediately.

Releases
--------
The 4.0.9 and 4.1.5 releases are available at the normal locations.

Workarounds
-----------
To avoid this vulnerability you will have to either remove all calls to
create_with, or carefully audit your codebase to ensure it sanitizes the
input first.  For example you should replace code like this:

  user.blog_posts.create_with(params[:blog_post]).create

with either:

  user.blog_posts.create(params[:blog_post])

or:

  user.blog_posts.create_with(params[:blog_post].permit(:title, :body,
:etc)).create


Patches
-------
To aid users who aren't able to upgrade immediately we have provided
patches for the two supported release series.  They are in git-am format
and consist of a single changeset.

* 4-1-create_with.patch - Patch for 4.1 series
* 4-0-create_with.patch - Patch for 4.0 series

Please note that only the 4.0.x and 4.1.x series receive regular security
updates at present.  Users of earlier unsupported releases are advised to
upgrade as soon as possible as we cannot guarantee the continued
availability of security fixes for earlier releases.

Credits
-------

Thanks to Stephen Touset of Square for reporting the vulnerability to us,
and to Jeff Jarmoc of Matasano and Charlie Somerville of GitHub for helping
verify the patches and advisories.

Comment 1 Kurt Seifried 2014-08-18 19:12:01 UTC
Created attachment 928054 [details]
4-0-create_with.patch

Comment 2 Kurt Seifried 2014-08-18 19:12:25 UTC
Created attachment 928055 [details]
4-1-create_with.patch

Comment 3 Kurt Seifried 2014-08-18 23:29:51 UTC
Upgraded severity to high as this could allow authentication bypass and privilege escalation.

Comment 7 Kurt Seifried 2014-08-25 15:11:49 UTC
Created rubygem-activerecord tracking bugs for this issue:

Affects: fedora-20 [bug 1133622]

Comment 8 Martin Prpič 2014-08-26 12:19:09 UTC
IssueDescription:

It was discovered that Active Record's create_with method failed to properly check attributes passed to it. A remote attacker could possibly use this flaw to bypass the strong parameter protection and modify arbitrary model attributes via mass assignment if an application using Active Record called create_with with untrusted values.

Comment 9 errata-xmlrpc 2014-08-27 14:22:13 UTC
This issue has been addressed in following products:

  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.4 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 7

Via RHSA-2014:1102 https://rhn.redhat.com/errata/RHSA-2014-1102.html

Comment 10 Fedora Update System 2014-09-26 09:01:10 UTC
rubygem-activerecord-4.0.0-5.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.