Ruby on Rails Multiple Vulnerabilities
BID:49179
Info
Ruby on Rails Multiple Vulnerabilities
| Bugtraq ID: | 49179 |
| Class: | Unknown |
| CVE: |
CVE-2011-2930 CVE-2011-2931 CVE-2011-3186 |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 16 2011 12:00AM |
| Updated: | Apr 13 2015 08:35PM |
| Credit: | Jan M. Faber, supersaas, Brent Miller, New Relic,Sascha Depold and Akira Matsuda and Falk Köppe |
| Vulnerable: |
Ruby on Rails Ruby on Rails 3.0.5 Ruby on Rails Ruby on Rails 3.0.4 Ruby on Rails Ruby on Rails 3.0.3 Ruby on Rails Ruby on Rails 3.0.2 Ruby on Rails Ruby on Rails 3.0.1 Ruby on Rails Ruby on Rails 3.0 Ruby on Rails Ruby on Rails 2.3.11 Ruby on Rails Ruby on Rails 2.3.10 Ruby on Rails Ruby on Rails 2.3.9 Ruby on Rails Ruby on Rails 2.3.5 Ruby on Rails Ruby on Rails 2.3.4 Ruby on Rails Ruby on Rails 2.3.3 Ruby on Rails Ruby on Rails 2.3.2 Ruby on Rails Ruby on Rails 2.3.12 Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 |
| Not Vulnerable: |
Ruby on Rails Ruby on Rails 3.1.0.rc6 Ruby on Rails Ruby on Rails 3.1.0.rc5 Ruby on Rails Ruby on Rails 3.0.10 Ruby on Rails Ruby on Rails 2.3.13 |
Discussion
Ruby on Rails Multiple Vulnerabilities
Ruby on Rails is prone to multiple vulnerabilities, including SQL-injection, information-disclosure, HTTP header-injection, security-bypass, and cross-site scripting issues.
Exploiting these issues can allow attackers to manipulate data, disclose sensitive information, inject arbitary HTTP headers, execute arbitrary script code, and bypass certain security restrictions.
Ruby on Rails versions prior to 2.3.13 and 3.0.10 are affected.
Ruby on Rails is prone to multiple vulnerabilities, including SQL-injection, information-disclosure, HTTP header-injection, security-bypass, and cross-site scripting issues.
Exploiting these issues can allow attackers to manipulate data, disclose sensitive information, inject arbitary HTTP headers, execute arbitrary script code, and bypass certain security restrictions.
Ruby on Rails versions prior to 2.3.13 and 3.0.10 are affected.
Exploit / POC
Ruby on Rails Multiple Vulnerabilities
An attacker can use a browser to exploit these issues. To exploit a cross-site scripting vulnerability, the attacker must entice an unsuspecting user to visit a crafted site.
An attacker can use a browser to exploit these issues. To exploit a cross-site scripting vulnerability, the attacker must entice an unsuspecting user to visit a crafted site.
Solution / Fix
Ruby on Rails Multiple Vulnerabilities
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.
References
Ruby on Rails Multiple Vulnerabilities
References:
References:
- Filter Skipping Vulnerability in Ruby on Rails 3.0 Options There are currently (Ruby on Rails)
- Response Splitting Vulnerability in Ruby on Rails (Ruby on Rails)
- SQL Injection Vulnerability in quote_table_name (Ruby on Rails)
- XSS Vulnerability in strip_tags helper (Ruby on Rails)
- XSS Vulnerability in the escaping function in Ruby on Rails (Ruby on Rails)
- Ruby on Rails Homepage (Ruby on Rails)