PT-2020-18351 · Rubygems · Administrate

Benoit Côté-Jodoin · Published 2020-03-13 · Updated 2020-03-18 · CVE-2020-5257

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Administrate (rubygem) versions prior to 0.13.0

Description The issue arises when sorting by attributes on a dashboard, where the direction parameter was not validated before being interpolated into the SQL query. This could present a SQL injection if the attacker were able to modify the direction parameter and bypass ActiveRecord SQL protections. To exploit this, access to the Administrate dashboards is needed, which is typically expected to be behind authentication.

Recommendations For versions prior to 0.13.0, update to version 0.13.0 to resolve the issue. As a temporary workaround, consider restricting access to the Administrate dashboards to minimize the risk of exploitation. Additionally, ensure that the direction parameter is properly validated before being used in SQL queries to prevent SQL injection attacks.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

CWE-943

Related Identifiers

CVE-2020-5257

GHSA-2P5P-M353-833W

Affected Products

Administrate

References · 8

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/administrate/CVE-2020-5257.yml · Exploit
• https://github.com/thoughtbot/administrate/commit/3ab838b83c5f565fba50e0c6f66fe4517f98eed3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-5257 · Security Note
• https://osv.dev/vulnerability/GHSA-2p5p-m353-833w · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-5257 · Vendor Advisory
• https://github.com/thoughtbot/administrate/security/advisories/GHSA-2p5p-m353-833w · Note
• https://github.com/advisories/GHSA-2p5p-m353-833w · Note
• https://t.me/cvenotify/1683 · Telegram Post