CVE-2020-5257 Sort order SQL injection in Administrate
Attackers with dashboard access can inject SQL via the sort direction parameter, potentially reading or modifying database records.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-5257?
CVE-2020-5257 is a high-severity SQL injection vulnerability in thoughtbot administrate, published on 13 Mar 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
In Administrate (rubygem) before version 0.13.0, when sorting by attributes on a dashboard, the direction parameter was not validated before being interpolated into the SQL query. This could present a SQL injection if the attacker were able to modify the `direction` parameter and bypass ActiveRecord SQL protections. Whilst this does have a high-impact, to exploit this you need access to the Administrate dashboards, which we would expect to be behind authentication. This is patched in wersion 0.13.0.
Which versions are affected by CVE-2020-5257?
2 open source packages ship an affected version, including administrate. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
administrate RubyGems | All versions | 0.13.0 |
administrate RubyGems | All versions | 0.13.0 |
Products include Thoughtbot Administrate.
How do I fix CVE-2020-5257?
Upgrade administrate to 0.13.0 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2020-5257 being exploited?
There is no known exploitation of CVE-2020-5257 in the wild and no public exploit code.
Other vulnerabilities in thoughtbot administrate
Sources
Also known as GHSA-2p5p-m353-833w.