CVE-2012-3424 actionpack Improper Authentication vulnerability

What is CVE-2012-3424?

CVE-2012-3424 is a medium-severity denial of service vulnerability in Rubyonrails Rails, published on 8 Aug 2012. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The decode_credentials method in actionpack/lib/action_controller/metal/http_authentication.rb in Ruby on Rails 3.x before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts Digest Authentication strings to symbols, which allows remote attackers to cause a denial of service by leveraging access to an application that uses a with_http_digest helper method, as demonstrated by the authenticate_or_request_with_http_digest method.

Weakness: CWE-287

Which versions are affected by CVE-2012-3424?

8 open source packages ship an affected version, including actionpack. It affects 2 products.

Products include Rubyonrails Rails, Rubyonrails Ruby on Rails.

How do I fix CVE-2012-3424?

Upgrade actionpack to a fixed version for your release line: 2.3.5, 3.0.16, 3.1.7 or 3.2.7.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2012-3424 being exploited?

There is no known exploitation of CVE-2012-3424 in the wild and no public exploit code.

Other vulnerabilities in Rubyonrails Rails

• CVE-2013-0277 Active Record contains deserialization of arbitrary YAML Critical 10.0
• CVE-2017-17916 SQL injection in n/a High 8.1
• CVE-2017-17917 SQL injection in n/a High 8.1
• CVE-2026-33195 Rails Active Storage has possible Path Traversal in DiskService High 8.0
• CVE-2024-26142 Rails possible ReDoS vulnerability in Accept header parsing in Action Dispatch High 7.5

All Rubyonrails Rails vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-92w9-2pqw-rhjj.