GHSA-wrrw-crp8-979q
Pageflow vulnerable to sensitive user data extraction via Ransack query injection
GHSA-wrrw-crp8-979q is a vulnerability with no CVSS score yet in pageflow, published September 15, 2022. No source lists public exploit code. Fixed in pageflow 14.5.2.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
14.5.2pageflow +3 more
Description
Impact
The attack allows extracting sensitive properties of database objects that are associated with users or entries belonging to an account that the attacker has access to.
Pageflow uses the ActiveAdmin Ruby library to provide some management features to its users. ActiveAdmin relies on the Ransack library to implement search functionality. In its default configuration, Ransack will allow for query conditions based on properties of associated database objects [1]. The *_starts_with, *_ends_with or *_contains search matchers [2] can then be abused to exfiltrate sensitive string values of associated database objects via character-by-character brute-force.
[1] https://activerecord-hackery.github.io/ransack/going-further/associations/ [2] https://activerecord-hackery.github.io/ransack/getting-started/search-matches/
Mitigation
Upgrade to version 15.7.1 or 14.5.2 of the pageflow gem.
For more information
If you have any questions or comments about this advisory email us at info(at)codevise.de
Credits
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pageflowRubyGems | before 14.5.2 | 14.5.2 |
pageflowRubyGems | 15.0.0 up to 15.7.1 | 15.7.1 |
pageflowRubyGems | before 14.5.2, plus listed versions 0.0.10.0.20.0.30.0.40.0.5 Show 45 moreShow less0.1.00.10.00.11.00.11.10.11.20.11.30.11.40.2.00.2.10.3.00.4.00.5.00.6.00.7.00.7.10.7.20.8.00.8.10.8.20.9.00.9.10.9.212.0.012.0.0.rc112.0.0.rc212.0.0.rc312.0.0.rc412.0.0.rc512.0.0.rc612.0.0.rc712.0.112.0.212.0.312.0.412.1.012.2.012.3.012.4.012.4.112.5.012.6.013.0.013.0.0.beta113.0.0.beta213.0.0.beta3 | 14.5.2 |
pageflowRubyGems | 15.0.0 up to 15.7.1, plus listed versions 15.0.115.0.215.1.015.1.0.beta115.1.0.beta2 Show 16 moreShow less15.1.0.beta315.1.0.beta415.1.0.beta515.1.0.beta615.1.0.rc015.1.115.1.215.2.015.2.115.2.215.3.015.4.015.5.015.6.015.6.115.7.0 | 15.7.1 |
What each source reports
GitHub AdvisoriesNo score
Pageflow vulnerable to sensitive user data extraction via Ransack query injection
Impact
The attack allows extracting sensitive properties of database objects that are associated with users or entries belonging to an account that the attacker has access to.
Pageflow uses the ActiveAdmin Ruby library to provide some management features to its users. ActiveAdmin relies on the Ransack library to implement search functionality. In its default configuration, Ransack will allow for query conditions based on properties of associated database objects [1]. The *_starts_with, *_ends_with or *_contains search matchers [2] can then be abused to exfiltrate sensitive string values of associated database objects via character-by-character brute-force.
[1] https://activerecord-hackery.github.io/ransack/going-further/associations/ [2] https://activerecord-hackery.github.io/ransack/getting-started/search-matches/
Mitigation
Upgrade to version 15.7.1 or 14.5.2 of the pageflow gem.
For more information
If you have any questions or comments about this advisory email us at info(at)codevise.de
Credits
- Record
GHSA-wrrw-crp8-979q- Updated
- 2026-11-02
OSVNo score
Pageflow vulnerable to sensitive user data extraction via Ransack query injection
Impact
The attack allows extracting sensitive properties of database objects that are associated with users or entries belonging to an account that the attacker has access to.
Pageflow uses the ActiveAdmin Ruby library to provide some management features to its users. ActiveAdmin relies on the Ransack library to implement search functionality. In its default configuration, Ransack will allow for query conditions based on properties of associated database objects [1]. The *_starts_with, *_ends_with or *_contains search matchers [2] can then be abused to exfiltrate sensitive string values of associated database objects via character-by-character brute-force.
[1] https://activerecord-hackery.github.io/ransack/going-further/associations/ [2] https://activerecord-hackery.github.io/ransack/getting-started/search-matches/
Mitigation
Upgrade to version 15.7.1 or 14.5.2 of the pageflow gem.
For more information
If you have any questions or comments about this advisory email us at info(at)codevise.de
Credits
- Record
GHSA-wrrw-crp8-979q- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
Left out here: 25 versions. The JSON record has them.