GHSA-534w-937m-v7x3

Suggest an improvement
Source
https://github.com/advisories/GHSA-534w-937m-v7x3
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/08/GHSA-534w-937m-v7x3/GHSA-534w-937m-v7x3.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-534w-937m-v7x3
Aliases
Published
2018-08-03T21:04:02Z
Modified
2024-02-16T08:08:58.530532Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
restforce vulnerable to Improper Input Validation
Details

A flaw in how restforce constructs URLs may allow an attacker to inject additional parameters into Salesforce API requests.

Impact

This flaw is only exploitable in applications that pass user input directly to restforce's select, find, describe, update, upsert, and destroy methods.

Vulnerable code might look like:

  client.select('SomeSalesForceObject', params[:some-id],
     ...)

In such an application, attackers could pass 0016000000MRatd/describe as a request parameter, causing the server to make a request to a different endpoint than the server is designed to handle. Since the Salesforce REST API supports overriding HTTP methods via a request parameter, an attacker could also cause the client's select() method to modify data, by passing 0016000000MRatd/?_HttpMethod=PATCH&other-query-params=....

Workarounds

If possible, applications should track salesforce IDs internally, rather than passing user-supplied IDs to salesforce. Such practice mitigates this vulnerability, and in general is desirable for ensuring strong access control.

Database specific 
{
    "nvd_published_at": "2018-08-03T20:29:00Z",
    "cwe_ids": [
        "CWE-172",
        "CWE-20"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T20:59:51Z"
}
References

Affected packages

RubyGems / restforce

Package

Name
restforce
Purl
pkg:gem/restforce

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.0.0

Affected versions

0.*

0.0.1
0.0.2
0.0.3
0.0.4
0.0.5
0.0.6
0.0.7
0.0.8
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.9
0.1.10

1.*

1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.1.0
1.2.0
1.3.0
1.4.0
1.4.1
1.4.2
1.4.3
1.5.0
1.5.1
1.5.2
1.5.3

2.*

2.0.0
2.1.0
2.1.1
2.1.2
2.1.3
2.2.0
2.2.1
2.3.0
2.4.0
2.4.1
2.4.2
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4