# rails-cve-2017-17917
The project demonstrates the replication of a SQL injection vulnerability in the <b>id</b> parameter, and subsequently provides insights into mitigating and resolving this security issue.
https://www.cvedetails.com/cve/CVE-2017-17917/?q=CVE-2017-17917
<b>Stack</b>:
```
Ruby: 3.2.2
Rails: 7.0.8
Docker 24.0.5
Docker-Compose 1.29.2
PostgreSQL
```
## [CVE-2017-17917](https://www.cvedetails.com/cve/CVE-2017-17917/?q=CVE-2017-17917)
We selected this CVE to highlight the persisting occurrence of this issue in the latest versions of Rails, reaffirming its relevance of the development best practices.
## Schema from the environment to replicate the vulnerability
## Instructions to replicate this vulnerability.
<b>Requirements: </b>
```
docker
docker-compose
```
<b>Steps to build a project</b>:
```
sudo docker-compose build
```
```
sudo docker-compose run web bundle install
```
```
sudo docker-compose run web rails db:create db:migrate db:seed
```
```
sudo docker-compose up
```
Go to http://localhost:3000/
SQL Injection param `1 OR id > 1`
## Assessing the risks of the vulnerability in a production environment.
With this SQL injection, an attacker can retrieve user data they wouldn't normally have access to view. <br/>
degree difficulty to execution: <b>easy</b>
## Conclusion
The issue lies in the controller method, specifically when invoking a where clause as follows: <br/>
``` @clients = Client.where("id = #{params[:id_search]}") ``` <br/>
[Link to Code](https://github.com/matiasarenhard/rails-cve-2017-17917/blob/main/app/controllers/clients_controller.rb#L7)
<br/>
The problem is resolved by using the following approach: <br/>
```@clients = Client.where(id: "#{params[:id_search]}")``` <br/>
[Link to Code](https://github.com/matiasarenhard/rails-cve-2017-17917/blob/main/app/controllers/clients_controller.rb#L10)
## Tests
```
sudo docker-compose run web rspec
```
[4.0K] /data/pocs/6f96a810dc0f07afac6bbeec70929671a1fc9d20
├── [4.0K] app
│ ├── [4.0K] assets
│ │ ├── [4.0K] config
│ │ │ └── [ 143] manifest.js
│ │ ├── [4.0K] images
│ │ └── [4.0K] stylesheets
│ │ └── [ 112] application.scss
│ ├── [4.0K] channels
│ │ └── [4.0K] application_cable
│ │ ├── [ 79] channel.rb
│ │ └── [ 85] connection.rb
│ ├── [4.0K] controllers
│ │ ├── [ 57] application_controller.rb
│ │ ├── [1.7K] clients_controller.rb
│ │ └── [4.0K] concerns
│ ├── [4.0K] helpers
│ │ ├── [ 29] application_helper.rb
│ │ └── [ 25] clients_helper.rb
│ ├── [4.0K] javascript
│ │ ├── [ 202] application.js
│ │ └── [4.0K] controllers
│ │ ├── [ 218] application.js
│ │ ├── [ 157] hello_controller.js
│ │ └── [ 584] index.js
│ ├── [4.0K] jobs
│ │ └── [ 269] application_job.rb
│ ├── [4.0K] mailers
│ │ └── [ 102] application_mailer.rb
│ ├── [4.0K] models
│ │ ├── [ 74] application_record.rb
│ │ ├── [ 228] client.rb
│ │ └── [4.0K] concerns
│ └── [4.0K] views
│ ├── [4.0K] clients
│ │ ├── [ 383] _client.html.erb
│ │ ├── [ 142] _client.json.jbuilder
│ │ ├── [ 149] edit.html.erb
│ │ ├── [1.5K] _form.html.erb
│ │ ├── [1.8K] index.html.erb
│ │ ├── [ 61] index.json.jbuilder
│ │ ├── [ 118] new.html.erb
│ │ ├── [1.2K] show.html.erb
│ │ └── [ 48] show.json.jbuilder
│ ├── [4.0K] layouts
│ │ ├── [ 592] application.html.erb
│ │ ├── [ 229] mailer.html.erb
│ │ └── [ 13] mailer.text.erb
│ └── [4.0K] shared
│ └── [ 451] _alerts.html.erb
├── [4.0K] bin
│ ├── [2.7K] bundle
│ ├── [ 91] importmap
│ ├── [ 141] rails
│ ├── [ 90] rake
│ └── [1010] setup
├── [4.0K] config
│ ├── [ 782] application.rb
│ ├── [ 207] boot.rb
│ ├── [ 233] cable.yml
│ ├── [ 464] credentials.yml.enc
│ ├── [ 332] database.yml
│ ├── [ 128] environment.rb
│ ├── [4.0K] environments
│ │ ├── [2.4K] development.rb
│ │ ├── [3.8K] production.rb
│ │ └── [2.3K] test.rb
│ ├── [ 409] importmap.rb
│ ├── [4.0K] initializers
│ │ ├── [ 580] assets.rb
│ │ ├── [1.0K] content_security_policy.rb
│ │ ├── [ 396] filter_parameter_logging.rb
│ │ ├── [ 649] inflections.rb
│ │ └── [ 384] permissions_policy.rb
│ ├── [4.0K] locales
│ │ └── [ 849] en.yml
│ ├── [1.8K] puma.rb
│ ├── [ 214] routes.rb
│ └── [1.1K] storage.yml
├── [ 160] config.ru
├── [4.0K] db
│ ├── [4.0K] migrate
│ │ └── [ 252] 20240119002301_create_clients.rb
│ ├── [1.1K] schema.rb
│ └── [ 403] seeds.rb
├── [ 449] docker-compose.yml
├── [ 372] Dockerfile
├── [ 216] entrypoint.sh
├── [2.7K] Gemfile
├── [6.8K] Gemfile.lock
├── [4.0K] lib
│ ├── [4.0K] assets
│ └── [4.0K] tasks
├── [4.0K] log
├── [4.0K] public
│ ├── [1.7K] 404.html
│ ├── [1.7K] 422.html
│ ├── [1.6K] 500.html
│ ├── [ 0] apple-touch-icon.png
│ ├── [ 0] apple-touch-icon-precomposed.png
│ ├── [ 0] favicon.ico
│ └── [ 99] robots.txt
├── [ 227] Rakefile
├── [3.1K] README.md
├── [4.0K] spec
│ ├── [4.0K] controllers
│ │ └── [1003] clients_controller_spec.rb
│ ├── [4.0K] factories
│ │ └── [ 284] clients.rb
│ ├── [4.0K] models
│ │ └── [1.1K] client_spec.rb
│ ├── [2.8K] rails_helper.rb
│ └── [4.5K] spec_helper.rb
├── [4.0K] storage
├── [4.0K] tmp
│ ├── [4.0K] pids
│ └── [4.0K] storage
└── [4.0K] vendor
└── [4.0K] javascript
42 directories, 76 files