GHSA-534W-937M-V7X3
Vulnerability from github – Published: 2018-08-03 21:04 – Updated: 2023-06-09 20:17A flaw in how restforce constructs URLs may allow an attacker to inject additional parameters into Salesforce API requests.
Impact
This flaw is only exploitable in applications that pass user input directly to restforce's select, find, describe, update, upsert, and destroy methods.
Vulnerable code might look like:
client.select('SomeSalesForceObject', params[:some-id],
...)
In such an application, attackers could pass 0016000000MRatd/describe as a request parameter, causing the server to make a request to a different endpoint than the server is designed to handle. Since the Salesforce REST API supports overriding HTTP methods via a request parameter, an attacker could also cause the client's select() method to modify data, by passing 0016000000MRatd/?_HttpMethod=PATCH&other-query-params=....
Workarounds
If possible, applications should track salesforce IDs internally, rather than passing user-supplied IDs to salesforce. Such practice mitigates this vulnerability, and in general is desirable for ensuring strong access control.
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "restforce"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-3777"
],
"database_specific": {
"cwe_ids": [
"CWE-172",
"CWE-20"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T20:59:51Z",
"nvd_published_at": "2018-08-03T20:29:00Z",
"severity": "CRITICAL"
},
"details": "A flaw in how restforce constructs URLs may allow an attacker to inject additional parameters into Salesforce API requests. \n\nImpact\n------\nThis flaw is only exploitable in applications that pass user input directly to restforce\u0027s select, find, describe, update, upsert, and destroy methods. \n\nVulnerable code might look like:\n```ruby\n client.select(\u0027SomeSalesForceObject\u0027, params[:some-id],\n ...)\n```\n\nIn such an application, attackers could pass `0016000000MRatd/describe` as a request parameter, causing the server to make a request to a different endpoint than the server is designed to handle. Since the Salesforce REST API supports overriding HTTP methods via a request parameter, an attacker could also cause the client\u0027s `select()` method to modify data, by passing `0016000000MRatd/?_HttpMethod=PATCH\u0026other-query-params=...`.\n\nWorkarounds\n------\nIf possible, applications should track salesforce IDs internally, rather than passing user-supplied IDs to salesforce. Such practice mitigates this vulnerability, and in general is desirable for ensuring strong access control.",
"id": "GHSA-534w-937m-v7x3",
"modified": "2023-06-09T20:17:46Z",
"published": "2018-08-03T21:04:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3777"
},
{
"type": "WEB",
"url": "https://github.com/restforce/restforce/pull/392"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-534w-937m-v7x3"
},
{
"type": "PACKAGE",
"url": "https://github.com/restforce/restforce"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/restforce/CVE-2018-3777.yml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "restforce vulnerable to Improper Input Validation"
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.