4 ms·
Stupid question, but how was that not discovered until now? That seems quite major, or something that the developers would have tested for ..
by TallboyOne 14y ago
Stupid question, but how was that not discovered until now? That seems quite major, or something that the developers would have tested for ..
- FooBarWidget 14y agoThe vulnerability doesn't get triggered normally. As the grandparent said, request parameters are stored in an object of class HashWithIndifferentAccess, which stores all keys as strings. For the vulnerability to be triggered, the keys must be symbols. You cannot trigger this vulnerability unless your have written code in your app which converts the HashWithIndifferentAccess to a normal hash. This patch does not fix a wide vulnerability. It just fixes a corner case, a just-in-case-somebody-might-write-vulnerable-code fix. It just so appears that Authlogic does this. They pass a cookie value into a dynamic finder, so you can tamper the cookie to inject SQL.
- TallboyOne 14y agoThanks for the great explanation, Sir widget.
- FooBarWidget 14y agoMore information here: http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-hold-your-horses-here-are-the-facts/ http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulner...