SQL Injection Vulnerability in Ruby on Rails (CVE-2012-5664)

[Colin Kelley]

https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/DCNTNp_qjFM%5B1-25-false%5D

If you use a dynamic finder fed from params, you're vulnerable.

(Thanks to our head of Ops, Matt Eldridge for the heads up here.)

-Colin

[Robert Schmitt]

A good explanation of the issue:

http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-hold-your-horses-here-are-the-facts/#.UOXr-j9680w

--
You received this message because you are subscribed to the Google Groups "sbonrails" group.
To view this discussion on the web visit https://groups.google.com/d/msg/sbonrails/-/gN0GZUwAiMEJ.
To post to this group, send email to sbon...@googlegroups.com.
To unsubscribe from this group, send email to sbonrails+...@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/sbonrails?hl=en.

[Colin Kelley]

Thanks for that pointer.  I noticed that Phusion blog post shows classic SQL injection where two statements are created from one:

User.find_by_name("kotori'; DROP TABLE USERS; --")
# => SELECT * FROM users WHERE name = 'kotori\'; DROP TABLE USERS; --' LIMIT 1

For those using MySQL, notice that it isn't vulnerable to that style because CLIENT_MULTI_STATEMENTS is disallowed by default; this is a rare case where MySQL is more secure than other database engines.  A MySQL injection into a SELECT cannot make any database changes.  At worst it could a) reveal secret information (anyone keep passwords in cleartext columns?) or b) overload the database and facilitate a Denial of Service attack.

Speaking of that, if you're using MySQL, make sure to set traditional mode.  Non-traditional mode was a bad idea.  Making it the default was even worse!

-Colin

[forest]

Since we are on the topic. This is a great tool to test your site for SQL Injection vulnerabilities.

https://github.com/sqlmapproject/sqlmap

And here are some very good blog posts on its use.

http://unconciousmind.blogspot.com/search/label/sqlmap

forest