rubygem-rails -- multiple vulnerabilities

Ruby on Rails blog: Rails 3.2.22, 4.1.11 and 4.2.2 have been released, along with web console and jquery-rails plugins and Rack 1.5.4 and 1.6.2...

CSRF vulnerability in OmniAuth's request phase

The request phase of the OmniAuth Ruby gem is vulnerable to Cross-Site Request Forgery CSRF when used as part of the Ruby on Rails framework, allowing accounts to be connected without user intent, user interaction, or feedback to the user. This permits a secondary account to be able to sign into...

Ruby on Rails: Changeable model ids on vanilla update can lead to severely bad side-effects

Proof of concept User.find1.update!id: 1701 But strong params! Disagree. There are cases where less experienced users will allow "id" as a param for a subnested resource and then copy and past that code into that subnested resource's own controller, forgetting to remove the "id". I consider this...

Hulihan Applications Amethyst HTML Injection Vulnerability

Hulihan Applications Amethyst is a U.S. Hulihan Applications, Inc. based on Ruby on Rails a set of open-source Web application framework based on the Ruby language of the open-source blog application . An HTML injection vulnerability exists in Hulihan Applications Amethyst, which stems from the...

Hulihan Applications Onyx Cross-Site Scripting Vulnerability

Hulihan Applications Onyx is a U.S. Hulihan Applications company based on Ruby on Rails a set of open source Web application framework based on the Ruby language of the open source image library , which provides customized themes , image uploads and image effects and other features . A cross-site...

Ruby on Rails ActiveModel::Name Remote Denial of Service Vulnerability

Ruby on Rails is a web application framework , built on top of the Ruby language . A security vulnerability in Rails ActiveModel::Name allows an attacker to send specially crafted data to an application, causing tojson to call ActiveModel::Name, which can cause the application to cause a dead loo...

Raritan PowerIQ 4.1 / 4.2 / 4.3 Code Execution

Raritan PowerIQ versions 4.1, 4.2, and 4.3 ship with a Rails 2 web interface with a hardcoded session secret of 8e238c9702412d475a4c44b7726a0537. This can be used to achieve unauthenticated remote code execution as the nginx user on vulnerable systems. msf exploitrailssecretdeserialization show...

Ruby on Rails 'to_json' Call Remote Denial of Service Vulnerability

Ruby on Rails Rails is the Rails core team to develop and maintain a set of open source Web application framework based on the Ruby language . A denial of service vulnerability exists in Ruby on Rails. A remote attacker can exploit this vulnerability to cause a denial of service...

Ruby on Rails: rails-ujs will send CSRF tokens to other origins

I reported this via email a few months ago. Here was my initial email: Hello, I've been playing with getting Rails apps to send CSRF tokens to the wrong domains and I found a few problems. The main motivation for this is in attacking a site that uses Content Security Policy. With CSP enabled, an...

[CVE-2015-1585] Fat Free CRM - CSRF Vulnerability in Version 0.13.5

CVE-2015-1585 Fat Free CRM - CSRF Vulnerability in Version 0.13.5 ---------------------------------------------------------------- Product Information: Software: Fat Free CRM Tested Version: 0.13.5, released 22.1.2015 with over 10.000 downloads Vulnerability Type: Cross-Site Request Forgery, CSRF...

Phusion Passenger Symbolic Link Attack Vulnerability (CNVD-2015-01260)

Phusion Passenger is an Apache module from the Dutch company Phusion for easier deployment of Ruby on Rails projects on Apache and Nginx web servers. Phusion Passenger 4.0.37 suffers from a symbolic link attack vulnerability due to the program not creating temporary files in a secure manner. An...

Fat Free CRM 0.13.5 Cross Site Request Forgery

CVE-2015-1585 Fat Free CRM - CSRF Vulnerability in Version 0.13.5 ---------------------------------------------------------------- Product Information: Software: Fat Free CRM Tested Version: 0.13.5, released 22.1.2015 with over 10.000 downloads Vulnerability Type: Cross-Site Request Forgery, CSRF...

Fat Free CRM 0.13.5 Cross Site Request Forgery Vulnerability

Fat Free CRM version 0.13.5 suffers from a cross site request forgery vulnerability. CVE-2015-1585 Fat Free CRM - CSRF Vulnerability in Version 0.13.5 ---------------------------------------------------------------- Product Information: Software: Fat Free CRM Tested Version: 0.13.5, released...

Ruby on Rails: JSON keys are not properly escaped

Rails does not escape hash keys properly in tojson when generating json. Values are escaped as expected ruby irbmain:001:0 "a"="".tojson = ""a":"\u003c\u003e"" However keys are not: ruby irbmain:002:0 ""="a".tojson = """:"a"" This is because the json gem calls .tos on the keys here which...

Ruby on Rails: RCE due to Web Console IP Whitelist bypass in Rails 4.0 and 4.1

With the release of Ruby on Rails 4.2 the so called Web Console was introduced. As the Web Console documentation states: Web Console is built explicitly for Rails 4. By default the Web Console is available in the Rails Development Environment and allows only the IPs 127.0.0.1 and ::1 to access th...

Important: Red Hat Security Advisory: cfme security, bug fix, and enhancement update

Updated cfme packages that fix two security issues, several bugs, and add various enhancements are now available for Red Hat CloudForms 3.1. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detaile...

Ruby on Rails: Denial of Service in Action Pack Exception Handling

Severity Medium Impact Attackers can cause an application to be unreachable, causing a denial of service condition. Details When a Rails application receives a request with either body or query parameters, these parameters are converted to a params hash. Hashes can be passed to the application in...

Ruby on Rails: Data-Tags and the New HTML Sanitizer Subverts CSRF protection

Possible XSS vulnerability in rails-html-sanitizer There is a possible XSS vulnerability in rails-html-sanitizer. This vulnerability has been assigned the CVE identifier CVE-2015-7578. Versions Affected: All. Not affected: None. Fixed Versions: 1.0.3 Impact ------ There is a possible XSS...

GLSA-201412-28 : Ruby on Rails: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201412-28 Ruby on Rails: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Ruby on Rails. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could execute arbitrary...

Ruby on Rails: Multiple vulnerabilities

Background Ruby on Rails is a web-application and persistence framework. Description Multiple vulnerabilities have been discovered in Ruby on Rails. Please review the CVE identifiers referenced below for details. Impact A remote attacker could execute arbitrary code or cause a Denial of Service...