N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-5qw5-wf2q-f538

GHSA-5qw5-wf2q-f538: ActiveRecord-JDBC-Adapter (AR-JDBC) lib/arjdbc/jdbc/adapter.rb sql.gsub() Function SQL Injection

ActiveRecord-JDBC-Adapter (AR-JDBC) contains a flaw that may allow carrying out an SQL injection attack. The issue is due to the sql.gsub() function in lib/arjdbc/jdbc/adapter.rb not properly sanitizing user-supplied input before using it in SQL queries. This may allow a remote attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-5qw5-wf2q-f538

GHSA-5qw5-wf2q-f538:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
activerecord-jdbc-adapter	rubygems	< 1.2.8	1.2.8

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an SQL injection flaw within the activerecord-jdbc-adapter library, specifically in the to_sql method located in lib/arjdbc/jdbc/adapter.rb. The root cause, as detailed in GitHub issue #322, is the improper use of Ruby's String#gsub method for substituting SQL bind parameters. The vulnerable code created a copy of the bind parameters and then used gsub with a block to replace '?' placeholders. However, if a bind value itself contained a '?', gsub would incorrectly perform a substitution on the already-placed value, corrupting the SQL query. This could be exploited by an attacker to manipulate the query structure. The fixing commit, 9bdf8b0940551885cebb28572497f4c8fa8d6a48, addresses this by modifying how the bind array is processed within the gsub block, preventing the double-substitution error. Therefore, the to_sql function is the precise location of the vulnerability.

Vulnerable functions

to_sql

lib/arjdbc/jdbc/adapter.rb

The `to_sql` function used `sql.gsub('?')` with a block to substitute bind parameters. When a bind parameter itself contained a question mark, the `gsub` implementation would incorrectly re-scan the substituted string and perform another replacement, leading to a corrupted SQL query and a potential SQL injection vulnerability. The vulnerable line `sql.gsub('?') { quote(*copy.shift.reverse) }` demonstrates this flawed substitution mechanism.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.