Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :limit and (2) :offset parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer.

The remote host is affected by the vulnerability described in GLSA-200912-02 (Ruby on Rails: Multiple vulnerabilities)

    The following vulnerabilities were discovered:
    sameer     reported that lib/action_controller/cgi_process.rb removes the     :cookie_only attribute from the default session options     (CVE-2007-6077), due to an incomplete fix for CVE-2007-5380 (GLSA     200711-17).
    Tobias Schlottke reported that the :limit and     :offset parameters of ActiveRecord::Base.find() are not properly     sanitized before being processed (CVE-2008-4094).
    Steve from     Coderrr reported that the CRSF protection in protect_from_forgery()     does not parse the text/plain MIME format (CVE-2008-7248).
    Nate reported a documentation error that leads to the assumption     that a block returning nil passed to     authenticate_or_request_with_http_digest() would deny access to the     requested resource (CVE-2009-2422).
    Brian Mastenbrook reported     an input sanitation flaw, related to multibyte characters     (CVE-2009-3009).
    Gabe da Silveira reported an input sanitation     flaw in the strip_tags() function (CVE-2009-4214).
    Coda Hale     reported an information disclosure vulnerability related to HMAC     digests (CVE-2009-3086).
  Impact :

    A remote attacker could send specially crafted requests to a vulnerable     application, possibly leading to the execution of arbitrary SQL     statements or a circumvention of access control. A remote attacker     could also conduct session fixation attacks to hijack a user's session     or bypass the CSRF protection mechanism, or furthermore conduct     Cross-Site Scripting attacks or forge a digest via multiple attempts.
  Workaround :

    There is no known workaround at this time.

Missing sanity checks of the :limit and :offset parameters in SQL queries could potentially be exploited to conduct SQL inection attacks (CVE-2008-4094).

Jonathan Weiss reports, that it is possible to perform a SQL injection in Rails applications via not correctly sanitized :limit and :offset parameters. It is possible to change arbitrary values in affected tables or gain access to the sensitive data.

Fixes CVE-2008-4094 (SQL injection in limit and offset clauses)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote server is running the Ruby on Rails web application.
This version of Rails is reported to be vulnerable to a flaw in the way that it handles ':offset' and ':limit' parameters. An attacker exploiting these flaws would only require the ability to send malformed requests to the application.  Successful exploitation would result in the attacker executing arbitrary SQL commands on the database used by Ruby on Rails.

ID	Name	Product	Family	Severity
43378	GLSA-200912-02 : Ruby on Rails: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
40124	openSUSE Security Update : rubygem-activerecord (rubygem-activerecord-328)	Nessus	SuSE Local Security Checks	high
36000	FreeBSD : rubygem-rails -- SQL injection vulnerability (8e8b8b94-7f1d-11dd-a66a-0019666436c2)	Nessus	FreeBSD Local Security Checks	high
34988	openSUSE 10 Security Update : rubygem-activerecord (rubygem-activerecord-5817)	Nessus	SuSE Local Security Checks	high
34423	Fedora 8 : rubygem-actionmailer-2.1.1-1.fc8 / rubygem-actionpack-2.1.1-1.fc8 / etc (2008-8282)	Nessus	Fedora Local Security Checks	high
34305	Fedora 9 : rubygem-actionmailer-2.1.1-1.fc9 / rubygem-actionpack-2.1.1-1.fc9 / etc (2008-8322)	Nessus	Fedora Local Security Checks	high
4679	Ruby on Rails < 2.1.1 Active Record Multiple Parameter SQL Injection	Nessus Network Monitor	Web Servers	high

Detections

Analytics

CVE-2008-4094

high

Tenable Plugins

high

high

high

high

high

high

high