PT-2013-1961 · Ruby On Rails · Authlogic

Published 2013-01-04 · Updated 2023-05-19 · CVE-2012-6497

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Authlogic gem for Ruby on Rails versions prior to 3.3.0

Description The issue allows remote attackers to conduct SQL injection attacks via a crafted parameter in environments with a known secret token value. This is demonstrated by a value contained in secret token.rb in an open-source product. The find by id method calls are potentially unsafe.

Recommendations For versions prior to 3.3.0, update to version 3.3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the find by id method to minimize the risk of exploitation. Avoid using crafted parameters in environments with a known secret token value until the issue is resolved.

Exploit

Fix

Information Disclosure

SQL injection

Weakness Enumeration

CWE-200

CWE-89

Related Identifiers

CVE-2012-6497

DSA-2597-1

GHSA-RX7J-MW4C-76G9

Affected Products

Authlogic

References · 15

• 🔥 http://phenoelit.org/blog/archives/2012/12/21/let_me_github_that_for_you/index.html · Exploit
• 🔥 http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-hold-your-horses-here-are-the-facts · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-6497 · Security Note
• https://osv.dev/vulnerability/CVE-2012-6497 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-6497 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rx7j-mw4c-76g9 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-6497 · Vendor Advisory
• https://github.com/binarylogic/authlogic/commit/1d57a6c4abe43a3c0b4ef578486ea00e1f7a9873 · Note
• https://github.com/binarylogic/authlogic · Note
• https://github.com/binarylogic/authlogic/pull/341 · Note
• http://securityfocus.com/bid/57084 · Note
• https://web.archive.org/web/20130104161608/http://securityfocus.com/bid/57084 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6497 · Note
• http://openwall.com/lists/oss-security/2013/01/03/12 · Note
• https://web.archive.org/web/20130116043311/http://phenoelit.org/blog/archives/2012/12/21/let_me_github_that_for_you/index.html · Note