# Unsafe Query Generation (CVE-2012-2660, CVE-2012-2694 and CVE-2013-0155) mitigation bypass

Rails JSON param parsing lets attackers pass [nil] or empty hash to bypass nil? checks and strip WHERE clauses in Active Record queries.

- Payout: hidden
- Severity: high
- Program: Ruby on Rails
- Found by: joernchen
- Disclosed: 2018-02-07
- CVE: CVE-2016-6317, CVE-2012-2660, CVE-2012-2694, CVE-2013-0155
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/139321
- Library page: https://bugbountylibrary.com/r/h1%3A139321
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:high tech:ruby technique:incomplete-fix technique:regression vuln:business-logic

**Target:** Active Record query builder with JSON parameter parsing
**Root cause:** JSON parameter parsing returns arrays/hashes for params that bypass nil? checks but are interpreted by Active Record as IN (NULL) or empty WHERE clauses.
**Steps:**
1. Send JSON body where token param is `[null]` or `{}`
2. App receives params[:token] as `[nil]` or empty hash
3. `unless params[:token].nil?` passes the check
4. `User.find_by_token(params[:token])` generates `IN ('xyz', NULL)` or drops WHERE clause
5. Password reset logic executes against unintended user or all users
**How found:** Variant analysis of prior CVEs (CVE-2012-2660, CVE-2012-2694, CVE-2013-0155) on the same unsafe query generation class, retested against JSON param parsing introduced in 4.2.
**Exploitation:** Attacker crafts JSON request with token as `[null]` or `{}` to bypass nil? guard, causing find_by_token to match unintended records or eliminate WHERE, enabling password reset of arbitrary/all accounts.
**Escalation:** Chaining with password reset token flow yields account takeover.
**Insight:** When a bug class is patched, retest the same sink against every new input parser (JSON, XML, YAML) added since — parser differentials reopen the same nil/empty-hash bypass.