Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS13cnJ3LWNycDgtOTc5cc4AAuzs

Pageflow vulnerable to sensitive user data extraction via Ransack query injection

Impact

The attack allows extracting sensitive properties of database objects that are associated with users or entries belonging to an account that the attacker has access to.

Pageflow uses the ActiveAdmin Ruby library to provide some management features to its users. ActiveAdmin relies on the Ransack library to implement search functionality. In its default configuration, Ransack will allow for query conditions based on properties of associated database objects [1]. The *_starts_with, *_ends_with or *_contains search matchers [2] can then be abused to exfiltrate sensitive string values of associated database objects via character-by-character brute-force.

[1] https://activerecord-hackery.github.io/ransack/going-further/associations/
[2] https://activerecord-hackery.github.io/ransack/getting-started/search-matches/

Mitigation

Upgrade to version 15.7.1 or 14.5.2 of the pageflow gem.

For more information

If you have any questions or comments about this advisory email us at info(at)codevise.de

Credits

Positive Security

Permalink: https://github.com/advisories/GHSA-wrrw-crp8-979q
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13cnJ3LWNycDgtOTc5cc4AAuzs
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 2 years ago
Updated: almost 2 years ago

Identifiers: GHSA-wrrw-crp8-979q
References:

• https://github.com/codevise/pageflow/security/advisories/GHSA-wrrw-crp8-979q
• https://github.com/codevise/pageflow/pull/1862
• https://github.com/advisories/GHSA-wrrw-crp8-979q

Repository: https://github.com/codevise/pageflow
Blast Radius: 0.0

Affected Packages