sqlite3-ruby: Possible SQL query truncation when a string is 4 GiB or larger

Summary

sqlite3-ruby cast Ruby string lengths (long) to int before passing them to SQLite. On 64-bit platforms, a string of 4 GiB (2^32 bytes) or larger had its length wrap, so SQLite saw only the first length mod 2^32 bytes. An attacker who controls the length of a SQL string could truncate the query, for example dropping a trailing WHERE clause. The affected paths are:

• the SQL passed to Database#prepare, #execute, and related methods
• String and Blob values passed to Statement#bind_param and related methods
• String and Blob values returned from SQL functions and aggregates defined in Ruby (Database#create_function, #create_aggregate, and related methods)

sqlite3 v2.10.2 raises RangeError when any of these strings is longer than INT_MAX bytes.

Severity

The sqlite3-ruby maintainers have evaluated this as medium severity (CVSS 4.8). Exploitation requires an attacker to get at least 4 GiB into a single SQL string or bound value. Most deployments reject a request body that large before the application sees it, and the server must hold several copies of the string in memory.

A truncated bound value is only a prefix of the attacker's input, so the bind paths matter only where the application validated the full value. A truncated SQL string is more serious: when the attacker's input is inlined into the SQL, the clauses that follow it are dropped. If a dropped clause contained a bind placeholder, binding raises SQLite3::RangeException instead of running the query.

Mitigation

Upgrade to sqlite3 v2.10.2 or later.

As a workaround for earlier versions, reject SQL strings and bound values of 4 GiB or larger before passing them to sqlite3-ruby, or limit request body size well below 4 GiB.

Credit

This issue was responsibly reported by Luke Jahnke from elttam.