Member-only story

Is my Rails app exposed to the each_key mass assignment bypass? 8.1.4.1 blocks one shape. A copied hash still passes.

Is your app exposed to GHSA-wm3x-v3qw-4jh3?

Raza Hussain

10 min read3 hours ago

Press enter or click to view image in full size Rails Strong Parameters Had a Mass Assignment Bypass All Along

I upgraded my lab to Rails 8.1.4.1, the release that fixed a Strong Parameters bypass on November 4. Then I ran the same helper again, and a user named Ana still came out with admin: true .

Ship the patch, because it closes a real hole. But it changes one return value.

The Rails mass assignment vulnerability I’d look for first in an older app is a plain Hash copied out of params . That was never in the advisory, and the patch doesn't change it.…