Headline
CVE-2023-34102: Merge pull request from GHSA-86h2-2g4g-29qx · avo-hq/avo@ec11788
Avo is an open source ruby on rails admin panel creation framework. The polymorphic field type stores the classes to operate on when updating a record with user input, and does not validate them in the back end. This can lead to unexpected behavior, remote code execution, or application crashes when viewing a manipulated record. This issue has been addressed in commit ec117882d which is expected to be included in subsequent releases. Users are advised to limit access to untrusted users until a new release is made.
Expand Up
@@ -199,11 +199,13 @@ def to_permitted_param
def fill_field(model, key, value, params)
return model unless model.methods.include? key.to_sym
valid_model_class = valid_polymorphic_class params[“#{polymorphic_as}_type”]
if polymorphic_as.present?
model.send("#{polymorphic_as}_type=", params[“#{polymorphic_as}_type”])
model.send("#{polymorphic_as}_type=", valid_model_class)
# If the type is blank, reset the id too.
if params[“#{polymorphic_as}_type”].blank?
if valid_model_class.blank?
model.send("#{polymorphic_as}_id=", nil)
else
model.send("#{polymorphic_as}_id=", params[“#{polymorphic_as}_id”])
Expand All
@@ -215,6 +217,12 @@ def fill_field(model, key, value, params)
model
end
def valid_polymorphic_class(possible_class)
types.find do |type|
type.to_s == possible_class.to_s
end
end
def database_id
# If the field is a polymorphic value, return the polymorphic_type as key and pre-fill the _id in fill_field.
return “#{polymorphic_as}_type” if polymorphic_as.present?
Expand Down
Related news
### Summary The polymorphic field type stores the classes to operate on when updating a record with user input, and does not validate them in the back end. This can lead to unexpected behavior, remote code execution, or application crashes when viewing a manipulated record. ### Details After reviewing the polymorphic field implementation and performing some black box approaches, we identified a potential security issue related to the use of safe_constantize / constantize. This Rails functionality is capable of searching for classes within the Rails context and returning the class for further use. Because Avo does not validate user input when updating or creating a new polymorphic resource, it is possible to create database entries with completely different or invalid class names than the preselected ones. Avo assumes that the class specified by the user request is a valid one and attempts to work with it, which may result in dangerous behavior and code execution. ### PoC ![image](ht...