Search code examples
ruby-on-railssql-injectionbrakeman

Is SQL Injection possible here?

I have run a static code analysis tool (brakeman) on a rails app and it has reported some SQL Injection vulnerabilities which I suspect may be false positives. The offending lines look like this:

#things_controller.rb

def index
  Thing.select(params[:columns]).where(params[:conditions])
end

I can't figure a way to exploit this, but it does seem rather open-ended, is this safe enough (this controller requires admin access anyway) or can it be exploited?

Ruby is 2.0.0-p247, Rails is 4.0.0

Solution

  • While rails has some built-in filters for special characters, this is definitely vulnerable:

    http://guides.rubyonrails.org/security.html#sql-injection

    If you want to test it yourself, run a full scan with sqlmap using the url of this action with a conditions GET parameter