SUMMARY

Ransack has a memory-exhaustion DoS via unbounded attribute position field in query params

Impact

This is (assuming any Ransack-using endpoint is accessible without auth, or any endpoint that performs a query before checking auth) an unauthenticated, low-complexity denial of service attack via memory exhaustion.

Any application that exposes a Ransack-backed search endpoint to untrusted input (which would be most of them) is affected. A single crafted request crashes the worker process serving it, and the attack depends on very minimal knowledge of the schema, and is not mitigated by any Rails best practices (strong params, ransack attribute whitelisting, etc.) that I am aware of.

All versions of Ransack since the initial release until the patch which mitigates it are vulnerable to this problem.