PT-2018-16195 · Salesforce · Restforce

Reedloden · Published 2018-08-03 · Updated 2023-02-28 · CVE-2018-3777

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions restforce versions prior to 3.0.0

Description The issue is related to insufficient URI encoding, allowing an attacker to inject arbitrary parameters into Salesforce API requests. This flaw is only exploitable in applications that pass user input directly to restforce's select, find, describe, update, upsert, and destroy methods. Attackers could manipulate the request to access different endpoints or modify data by overriding HTTP methods via request parameters, such as HttpMethod=PATCH.

Recommendations For versions prior to 3.0.0, consider updating to version 3.0.0 or later to resolve the issue. As a temporary workaround, applications should track Salesforce IDs internally rather than passing user-supplied IDs to Salesforce to mitigate this vulnerability.

Exploit

Fix

RCE

Weakness Enumeration

CWE-172

CWE-20

Related Identifiers

CVE-2018-3777

GHSA-534W-937M-V7X3

Affected Products

Restforce

References · 7

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/restforce/CVE-2018-3777.yml · Exploit
• https://osv.dev/vulnerability/CVE-2018-3777 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-3777 · Security Note
• https://osv.dev/vulnerability/GHSA-534w-937m-v7x3 · Vendor Advisory
• https://github.com/restforce/restforce/pull/392 · Note
• https://github.com/restforce/restforce · Note
• https://github.com/advisories/GHSA-534w-937m-v7x3 · Note