restforce

Version	Released
`8.0.1` patch	Dec 29, 2025
`8.0.0` major	Dec 18, 2024
`7.6.0` minor	Dec 18, 2024
`7.5.0` minor	Sep 04, 2024
`7.4.0` minor	Jul 10, 2024
`7.3.1` patch	Mar 30, 2024
`7.3.0` minor	Feb 14, 2024
`7.1.1` patch	Jan 23, 2024
`7.2.0` minor	Jan 23, 2024
`7.1.0` minor	Dec 20, 2023
`6.2.4` patch	Oct 06, 2023
`7.0.0` major	Oct 06, 2023
`6.2.3` patch	Jun 18, 2023
`6.2.2` patch	Mar 24, 2023
`6.2.1` patch	Jan 18, 2023
`6.2.0` minor	Jan 18, 2023
`6.1.0` minor	Nov 18, 2022
`6.0.0` major	Sep 09, 2022
`6.0.0.rc.1` pre	Aug 04, 2022
`5.3.1` patch	Jul 19, 2022
`5.3.0` minor	May 30, 2022
`5.2.4` patch	Mar 16, 2022
`5.2.3` patch	Jan 17, 2022
`5.2.2` patch	Dec 16, 2021
`5.2.1` patch	Dec 08, 2021
`3.2.1` patch	Dec 08, 2021
`5.2.0` minor	Oct 15, 2021
`5.1.1` patch	Oct 13, 2021
`5.1.0` minor	Aug 26, 2021
`5.0.6` patch	Jun 17, 2021
`5.0.5` patch	Feb 17, 2021
`4.3.0` minor	Feb 10, 2021
`5.0.4` patch	Jan 18, 2021
`5.0.3` patch	Sep 08, 2020
`5.0.2` patch	Sep 06, 2020
`5.0.1` patch	Aug 13, 2020
`5.0.0` major	Jul 10, 2020
`4.2.2` patch	Jan 23, 2020
`4.2.1` patch	Dec 04, 2019
`4.2.0` minor	Oct 23, 2019
`4.1.0` minor	Oct 20, 2019
`4.0.0` major	Oct 09, 2019
`3.2.0` minor	Oct 09, 2019
`2.5.4` patch 1 CVE	May 15, 2019
`3.1.0` minor	Aug 16, 2018
`3.0.1` patch	Aug 04, 2018
`3.0.0` major	Aug 02, 2018
`2.5.3` patch 1 CVE	Apr 25, 2017
`2.5.2` patch 1 CVE	Apr 03, 2017
`2.5.1` patch 1 CVE	Mar 16, 2017

8.0.1 patch

Dec 29, 2025

8.0.0 major

Dec 18, 2024

7.6.0 minor

Dec 18, 2024

7.5.0 minor

Sep 04, 2024

7.4.0 minor

Jul 10, 2024

7.3.1 patch

Mar 30, 2024

7.3.0 minor

Feb 14, 2024

7.1.1 patch

Jan 23, 2024

7.2.0 minor

Jan 23, 2024

7.1.0 minor

Dec 20, 2023

6.2.4 patch

Oct 06, 2023

7.0.0 major

Oct 06, 2023

6.2.3 patch

Jun 18, 2023

6.2.2 patch

Mar 24, 2023

6.2.1 patch

Jan 18, 2023

6.2.0 minor

Jan 18, 2023

6.1.0 minor

Nov 18, 2022

6.0.0 major

Sep 09, 2022

6.0.0.rc.1 pre

Aug 04, 2022

5.3.1 patch

Jul 19, 2022

5.3.0 minor

May 30, 2022

5.2.4 patch

Mar 16, 2022

5.2.3 patch

Jan 17, 2022

5.2.2 patch

Dec 16, 2021

5.2.1 patch

Dec 08, 2021

3.2.1 patch

Dec 08, 2021

5.2.0 minor

Oct 15, 2021

5.1.1 patch

Oct 13, 2021

5.1.0 minor

Aug 26, 2021

5.0.6 patch

Jun 17, 2021

5.0.5 patch

Feb 17, 2021

4.3.0 minor

Feb 10, 2021

5.0.4 patch

Jan 18, 2021

5.0.3 patch

Sep 08, 2020

5.0.2 patch

Sep 06, 2020

5.0.1 patch

Aug 13, 2020

5.0.0 major

Jul 10, 2020

4.2.2 patch

Jan 23, 2020

4.2.1 patch

Dec 04, 2019

4.2.0 minor

Oct 23, 2019

4.1.0 minor

Oct 20, 2019

4.0.0 major

Oct 09, 2019

3.2.0 minor

Oct 09, 2019

2.5.4 patch

1 CVE

CVE-2018-3777 GHSA-534w-937m-v7x3 Aug 03, 2018

restforce vulnerable to Improper Input Validation

9.8 / 10

Critical

Network Low None None Unchanged High High High

A flaw in how restforce constructs URLs may allow an attacker to inject additional parameters into Salesforce API requests.

Impact

This flaw is only exploitable in applications that pass user input directly to restforce's select, find, describe, update, upsert, and destroy methods.

Vulnerable code might look like:

  client.select('SomeSalesForceObject', params[:some-id],
     ...)

In such an application, attackers could pass 0016000000MRatd/describe as a request parameter, causing the server to make a request to a different endpoint than the server is designed to handle. Since the Salesforce REST API supports overriding HTTP methods via a request parameter, an attacker could also cause the client's select() method to modify data, by passing 0016000000MRatd/?_HttpMethod=PATCH&other-query-params=....

Workarounds

If possible, applications should track salesforce IDs internally, rather than passing user-supplied IDs to salesforce. Such practice mitigates this vulnerability, and in general is desirable for ensuring strong access control.

Affected versions


          0.0.1


          0.0.2


          0.0.3


          0.0.4


          0.0.5


          0.0.6


          0.0.7


          0.0.8


          0.1.0


          0.1.1


          0.1.10


          0.1.2

+ 41 more


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.1.0


            1.2.0


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            2.0.0


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.2.0


            2.2.1


            2.3.0


            2.4.0


            2.4.1


            2.4.2


            2.5.0


            2.5.1


            2.5.2


            2.5.3


            2.5.4

Fixed in


          3.0.0

References

Updated Feb 16, 2024 · Source: OSV.dev

May 15, 2019

3.1.0 minor

Aug 16, 2018

3.0.1 patch

Aug 04, 2018

3.0.0 major

Aug 02, 2018

2.5.3 patch

1 CVE

CVE-2018-3777 GHSA-534w-937m-v7x3 Aug 03, 2018

restforce vulnerable to Improper Input Validation

9.8 / 10

Critical

Network Low None None Unchanged High High High

A flaw in how restforce constructs URLs may allow an attacker to inject additional parameters into Salesforce API requests.

Impact

This flaw is only exploitable in applications that pass user input directly to restforce's select, find, describe, update, upsert, and destroy methods.

Vulnerable code might look like:

  client.select('SomeSalesForceObject', params[:some-id],
     ...)

In such an application, attackers could pass 0016000000MRatd/describe as a request parameter, causing the server to make a request to a different endpoint than the server is designed to handle. Since the Salesforce REST API supports overriding HTTP methods via a request parameter, an attacker could also cause the client's select() method to modify data, by passing 0016000000MRatd/?_HttpMethod=PATCH&other-query-params=....

Workarounds

If possible, applications should track salesforce IDs internally, rather than passing user-supplied IDs to salesforce. Such practice mitigates this vulnerability, and in general is desirable for ensuring strong access control.

Affected versions


          0.0.1


          0.0.2


          0.0.3


          0.0.4


          0.0.5


          0.0.6


          0.0.7


          0.0.8


          0.1.0


          0.1.1


          0.1.10


          0.1.2

+ 41 more


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.1.0


            1.2.0


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            2.0.0


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.2.0


            2.2.1


            2.3.0


            2.4.0


            2.4.1


            2.4.2


            2.5.0


            2.5.1


            2.5.2


            2.5.3


            2.5.4

Fixed in


          3.0.0

References

Updated Feb 16, 2024 · Source: OSV.dev

Apr 25, 2017

2.5.2 patch

1 CVE

CVE-2018-3777 GHSA-534w-937m-v7x3 Aug 03, 2018

restforce vulnerable to Improper Input Validation

9.8 / 10

Critical

Network Low None None Unchanged High High High

A flaw in how restforce constructs URLs may allow an attacker to inject additional parameters into Salesforce API requests.

Impact

This flaw is only exploitable in applications that pass user input directly to restforce's select, find, describe, update, upsert, and destroy methods.

Vulnerable code might look like:

  client.select('SomeSalesForceObject', params[:some-id],
     ...)

In such an application, attackers could pass 0016000000MRatd/describe as a request parameter, causing the server to make a request to a different endpoint than the server is designed to handle. Since the Salesforce REST API supports overriding HTTP methods via a request parameter, an attacker could also cause the client's select() method to modify data, by passing 0016000000MRatd/?_HttpMethod=PATCH&other-query-params=....

Workarounds

If possible, applications should track salesforce IDs internally, rather than passing user-supplied IDs to salesforce. Such practice mitigates this vulnerability, and in general is desirable for ensuring strong access control.

Affected versions


          0.0.1


          0.0.2


          0.0.3


          0.0.4


          0.0.5


          0.0.6


          0.0.7


          0.0.8


          0.1.0


          0.1.1


          0.1.10


          0.1.2

+ 41 more


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.1.0


            1.2.0


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            2.0.0


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.2.0


            2.2.1


            2.3.0


            2.4.0


            2.4.1


            2.4.2


            2.5.0


            2.5.1


            2.5.2


            2.5.3


            2.5.4

Fixed in


          3.0.0

References

Updated Feb 16, 2024 · Source: OSV.dev

Apr 03, 2017

2.5.1 patch

1 CVE

CVE-2018-3777 GHSA-534w-937m-v7x3 Aug 03, 2018

restforce vulnerable to Improper Input Validation

9.8 / 10

Critical

Network Low None None Unchanged High High High

A flaw in how restforce constructs URLs may allow an attacker to inject additional parameters into Salesforce API requests.

Impact

This flaw is only exploitable in applications that pass user input directly to restforce's select, find, describe, update, upsert, and destroy methods.

Vulnerable code might look like:

  client.select('SomeSalesForceObject', params[:some-id],
     ...)

In such an application, attackers could pass 0016000000MRatd/describe as a request parameter, causing the server to make a request to a different endpoint than the server is designed to handle. Since the Salesforce REST API supports overriding HTTP methods via a request parameter, an attacker could also cause the client's select() method to modify data, by passing 0016000000MRatd/?_HttpMethod=PATCH&other-query-params=....

Workarounds

If possible, applications should track salesforce IDs internally, rather than passing user-supplied IDs to salesforce. Such practice mitigates this vulnerability, and in general is desirable for ensuring strong access control.

Affected versions


          0.0.1


          0.0.2


          0.0.3


          0.0.4


          0.0.5


          0.0.6


          0.0.7


          0.0.8


          0.1.0


          0.1.1


          0.1.10


          0.1.2

+ 41 more


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.0.4


            1.0.5


            1.0.6


            1.1.0


            1.2.0


            1.3.0


            1.4.0


            1.4.1


            1.4.2


            1.4.3


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            2.0.0


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.2.0


            2.2.1


            2.3.0


            2.4.0


            2.4.1


            2.4.2


            2.5.0


            2.5.1


            2.5.2


            2.5.3


            2.5.4

Fixed in


          3.0.0

References

Updated Feb 16, 2024 · Source: OSV.dev

Mar 16, 2017

Activity

Reach

Details

Impact

Workarounds

Impact

Workarounds

Impact

Workarounds

Impact

Workarounds

Impact

Workarounds