restforce 0.1.2

1 security vulnerability found in version 0.1.2

Insufficient URI encoding in restforce

critical severity CVE-2018-3777
critical severity CVE-2018-3777
Patched versions: ~> 2.5.4, >= 3.0.0

A flaw in how restforce constructs URL's may allow an attacker to inject additional parameters into Salesforce API requests.

Impact

This flaw is only exploitable in applications that pass user input directly to restforce's select, find, describe, update, upsert, and destroy methods. Vulnerable code might look like:

client.select('SomeSalesForceObject', params[:some-id],
   ...)

In such an application, attackers could pass 0016000000MRatd/describe as a request parameter, causing the server to make a request to a different endpoint than the server is designed to handle. Since the Salesforce REST API supports overriding HTTP methods via a request parameter, an attacker could also cause the client's select() method to modify data, by passing 0016000000MRatd/?_HttpMethod=PATCH&other-query-params=....

Workarounds

If possible, applications should track salesforce IDs internally, rather than passing user-supplied IDs to salesforce. Such practice mitigates this vulnerability, and in general is desirable for ensuring strong access control.

No officially reported memory leakage issues detected.


This gem version does not have any officially reported memory leaked issues.

Author did not declare license for this gem in the gemspec.


This gem version has a MIT license in the source code, however it was not declared in the gemspec file.

This gem version is available.


This gem version has not been yanked and is still available for usage.