CVE-2015-7577
rails Severe
Attribute Restriction
Discovered over 4 years ago
Published over 4 years ago
Category: Attribute Restriction
Source: NIST NVD
Severity: Severe

There is a vulnerability in how the nested attributes feature in Active Record handles updates in combination with destroy flags when destroying records is disabled. This vulnerability has been assigned the CVE identifier CVE-2015-7577.

Versions Affected: 3.1.0 and newer Not affected: 3.0.x and older Fixed Versions: 5.0.0.beta1.1, 4.2.5.1, 4.1.14.1, 3.2.22.1

Impact

When using the nested attributes feature in Active Record you can prevent the destruction of associated records by passing the allow_destroy: false option to the accepts_nested_attributes_for method. However due to a change in the commit a9b4b5d the _destroy flag prevents the :reject_if proc from being called because it assumes that the record will be destroyed anyway.

However this isn’t true if :allow_destroy is false so this leads to changes that would have been rejected being applied to the record. Attackers could use this do things like set attributes to invalid values and to clear all of the attributes amongst other things. The severity will be dependent on how the application has used this feature.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases

The FIXED releases are available at the normal locations.

Workarounds

If you can’t upgrade, please use the following monkey patch in an initializer that is loaded before your application:

$ cat config/initializers/nested_attributes_bypass_fix.rb 
module ActiveRecord 
  module NestedAttributes 
    private 

    def reject_new_record?(association_name, attributes) 
      will_be_destroyed?(association_name, attributes) || call_reject_if(association_name, attributes) 
    end 

    def call_reject_if(association_name, attributes) 
      return false if will_be_destroyed?(association_name, attributes) 

      case callback = self.nested_attributes_options[association_name][:reject_if] 
      when Symbol 
        method(callback).arity == 0 ? send(callback) : send(callback, attributes) 
      when Proc 
        callback.call(attributes) 
      end 
    end 

    def will_be_destroyed?(association_name, attributes) 
      allow_destroy?(association_name) && has_destroy_flag?(attributes) 
    end 

    def allow_destroy?(association_name) 
      self.nested_attributes_options[association_name][:allow_destroy] 
    end 
  end 
end 

Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

  • 3-2-nested-attributes-reject-if-bypass.patch - Patch for 3.2 series
  • 4-1-nested-attributes-reject-if-bypass.patch - Patch for 4.1 series
  • 4-2-nested-attributes-reject-if-bypass.patch - Patch for 4.2 series
  • 5-0-nested-attributes-reject-if-bypass.patch - Patch for 5.0 series

Please note that only the 4.1.x and 4.2.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

Credits

Thank you to Justin Coyne for reporting the problem and working with us to fix it.

CVSS Metrics
Access Vector Access Complexity Authentication Confidentiality Impact Integrity Impact Availability Impact
Network Network None None Partial None
Patched Versions

>= 5.0.0.beta1.1 ~> 4.2.5 >= 4.2.5.1 ~> 4.1.14 >= 4.1.14.1 ~> 3.2.22.1

Unaffected Versions

~> 3.0.0 < 3.0.0