Описание
Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters.
A flaw was found in the way the Active Model based models processed attributes. An attacker with the ability to pass arbitrary attributes to models could possibly use this flaw to bypass input validation.
Меры по смягчению последствий
Do not allow arbitrary attributes to be passed to models. In Rails with Strong Parameters, make sure to not call permit! method, which bypasses strong parameters protections. Outside of rails, use whitelisting to filter only allowed attributes before passing them to models.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| CloudForms Management Engine 5.2 | ruby193-rubygem-activemodel | Not affected | ||
| CloudForms Management Engine 5.2 | ruby193-rubygem-activerecord | Not affected | ||
| CloudForms Management Engine 5.3 | ruby193-rubygem-activemodel | Not affected | ||
| CloudForms Management Engine 5.3 | ruby193-rubygem-activerecord | Not affected | ||
| OpenStack Foreman | ruby193-rubygem-activerecord | Not affected | ||
| Red Hat Software Collections | ror40-rubygem-activemodel | Not affected | ||
| Red Hat Software Collections | ror40-rubygem-activerecord | Not affected | ||
| Red Hat Software Collections | ruby193-rubygem-activemodel | Not affected | ||
| Red Hat Software Collections | ruby193-rubygem-activerecord | Not affected | ||
| Red Hat Subscription Asset Manager | ruby193-rubygem-activemodel | Not affected |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
4.3 Medium
CVSS2
Связанные уязвимости
Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters.
Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters.
Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2. ...
Уязвимость программной платформы Ruby on Rails, позволяющая нарушителю обойти механизм проверки правильности данных
EPSS
4.3 Medium
CVSS2