SQL Injection in "sort" parameter on /users/ page

[tsparksh]

What happened just before the problem occurred

SQL injection (SQLi) refers to an injection attack wherein an attacker can execute malicious SQL statements that control a web application's database server. An attacker can use SQL injection it to bypass a web application's authentication and authorization mechanisms and retrieve the contents of an entire database. SQLi can also be used to add, modify and delete records in a database, affecting data integrity. Under the right circumstances, SQLi can also be used by an attacker to execute OS commands, which may then be used to escalate an attack even further.

Due to the lack of filtering of the sort parameter, SQL injection is possible (near ORDER BY)

Demonstration:
http://mapknitter.org/users/?sort=asdasd =>
SELECT users.*, count(users.id) as maps_count FROM 'users' INNER JOIN 'maps' ON 'maps'.'user_id' = 'users'.'id' GROUP BY maps.user_id ORDER BY asdasd desc LIMIT 24 OFFSET 0

Relevant URLs

http://mapknitter.org/users/

How to fix

Use parameterized queries when dealing with SQL queries that contains user input. Parameterized queries allows the database to understand which parts of the SQL query should be considered as user input, therefore solving SQL injection.

[welcome]

Thanks for opening your first issue here! Please follow the issue template to help us help you 👍🎉😄
If you have screenshots to share demonstrating the issue, that's really helpful! 📸 You can make a gif too!

[Uzay-G]

I'm not sure security errors like this should be reported in open issues.

[tsparksh]

Hey, @Uzay-G. We already have some security reports opened (publiclab/plots2#3966, publiclab/plots2#744, publiclab/plots2#3549). So I don’t think this is a problem.

@jywarren, can you check this and publiclab/plots2#7133, please? How should I report such security issues?

[jywarren]

I think we can look to the controllers where this is affected:

mapknitter/app/controllers/users_controller.rb

Line 16 in 4f11b9e

.order(sort_column + ' ' + sort_direction)

I think it should be:

.order("? ?", sort_column, sort_direction)

Then Rails will sanitize the params! Can we make this change now?

[StlMaris123]

Is there anyone working on this? I would love to work on it

[tsparksh]

@StlMaris123, sure, go ahead!