Rubysec

Providing security resources for the Ruby community.
Follow us @rubysec or email us via info at rubysec.com

Advisory Archive

Back

---
gem: activerecord
date: 2016-01-25
url: https://groups.google.com/forum/#!topic/rubyonrails-security/cawsWcQ6c8g
cve: 2015-7577
title: Nested attributes rejection proc bypass in Active Record
description: |
  There is a vulnerability in how the nested attributes feature in Active Record
  handles updates in combination with destroy flags when destroying records is
  disabled. This vulnerability has been assigned the CVE identifier CVE-2015-7577.

  Versions Affected:  3.1.0 and newer
  Not affected:       3.0.x and older
  Fixed Versions:     5.0.0.beta1.1, 4.2.5.1, 4.1.14.1, 3.2.22.1

  Impact
  ------
  When using the nested attributes feature in Active Record you can prevent the
  destruction of associated records by passing the `allow_destroy: false` option
  to the `accepts_nested_attributes_for` method. However due to a change in the
  commit [a9b4b5d][1] the `_destroy` flag prevents the `:reject_if` proc from
  being called because it assumes that the record will be destroyed anyway.

  However this isn't true if `:allow_destroy` is false so this leads to changes
  that would have been rejected being applied to the record. Attackers could use
  this do things like set attributes to invalid values and to clear all of the
  attributes amongst other things. The severity will be dependent on how the
  application has used this feature.

  All users running an affected release should either upgrade or use one of
  the workarounds immediately.

  Releases
  --------
  The FIXED releases are available at the normal locations.

  Workarounds
  -----------
  If you can't upgrade, please use the following monkey patch in an initializer
  that is loaded before your application:

  ```
  $ cat config/initializers/nested_attributes_bypass_fix.rb
  module ActiveRecord
    module NestedAttributes
      private

      def reject_new_record?(association_name, attributes)
        will_be_destroyed?(association_name, attributes) || call_reject_if(association_name, attributes)
      end

      def call_reject_if(association_name, attributes)
        return false if will_be_destroyed?(association_name, attributes)

        case callback = self.nested_attributes_options[association_name][:reject_if]
        when Symbol
          method(callback).arity == 0 ? send(callback) : send(callback, attributes)
        when Proc
          callback.call(attributes)
        end
      end

      def will_be_destroyed?(association_name, attributes)
        allow_destroy?(association_name) && has_destroy_flag?(attributes)
      end

      def allow_destroy?(association_name)
        self.nested_attributes_options[association_name][:allow_destroy]
      end
    end
  end
  ```

  Patches
  -------
  To aid users who aren't able to upgrade immediately we have provided patches for
  the two supported release series. They are in git-am format and consist of a
  single changeset.

  * 3-2-nested-attributes-reject-if-bypass.patch - Patch for 3.2 series
  * 4-1-nested-attributes-reject-if-bypass.patch - Patch for 4.1 series
  * 4-2-nested-attributes-reject-if-bypass.patch - Patch for 4.2 series
  * 5-0-nested-attributes-reject-if-bypass.patch - Patch for 5.0 series

  Please note that only the 4.1.x and 4.2.x series are supported at present. Users
  of earlier unsupported releases are advised to upgrade as soon as possible as we
  cannot guarantee the continued availability of security fixes for unsupported
  releases.

  Credits
  -------
  Thank you to Justin Coyne for reporting the problem and working with us to fix it.

  [1]: https://github.com/rails/rails/commit/a9b4b5da7c216e4464eeb9dbd0a39ea258d64325
unaffected_versions:
- "~> 3.0.0"
- "< 3.0.0"
patched_versions:
- ">= 5.0.0.beta1.1"
- "~> 4.2.5, >= 4.2.5.1"
- "~> 4.1.14, >= 4.1.14.1"
- "~> 3.2.22.1"