There is a SQL injection vulnerability in Active Record, version 3.0
and later. This vulnerability has been assigned the CVE identifier
CVE-2012-2661.
Versions Affected: 3.0.0 and ALL later versions
Not affected: 2.3.14
Fixed Versions: 3.2.4, 3.1.5, 3.0.13
Impact
------
Due to the way Active Record handles nested query parameters, an
attacker can use a specially crafted request to inject some forms of
SQL into your application's SQL queries.
All users running an affected release should upgrade immediately.
Impacted code directly passes request params to the `where` method of
an ActiveRecord class like this:
Post.where(:id => params[:id]).all
An attacker can make a request that causes `params[:id]` to return a
specially crafted hash that will cause the WHERE clause of the SQL
statement to query an arbitrary table with some value.
Releases
--------
The FIXED releases are available at the normal locations.
Workarounds
-----------
This issue can be mitigated by casting the parameter to an expected
value. For example, change this:
There is a SQL injection vulnerability in Active Record, version 3.0 and later. This vulnerability has been assigned the CVE identifier CVE-2012-2661.
Versions Affected: 3.0.0 and ALL later versions
Not affected: 2.3.14
Fixed Versions: 3.2.4, 3.1.5, 3.0.13
Impact
------
Due to the way Active Record handles nested query parameters, an attacker can use a specially crafted request to inject some forms of SQL into your application's SQL queries.
All users running an affected release should upgrade immediately.
Impacted code directly passes request params to the `where` method of an ActiveRecord class like this:
An attacker can make a request that causes `params[:id]` to return a specially crafted hash that will cause the WHERE clause of the SQL statement to query an arbitrary table with some value.
Releases
--------
The FIXED releases are available at the normal locations.
Workarounds
-----------
This issue can be mitigated by casting the parameter to an expected value. For example, change this:
to this: