Multiple vulnerabilities in parameter parsing in Action Pack • Hacker News Board

Re: Multiple vulnerabilities in parameter parsing in Action Pack

#11

Post by tptacek » Tue, Jan 08, 2013, 8:27 PM UTC

10char wrote: post #10

Correct me if I'm wrong, but looks like this should only be a vulnerability if your app uses XML parameters?

No, it's a vulnerability if your app SUPPORTS XML parameters, which all modern Rails apps do.

This vulnerability is exploitable even if you don't have any exposed controllers.

Re: Multiple vulnerabilities in parameter parsing in Action Pack

#12

Post by danso » Tue, Jan 08, 2013, 8:28 PM UTC

tptacek wrote: post #6

danso wrote: post #5

Before anyone wonders if they're having deja vu, this is different than the SQL injection vulnerability that was discussed 5 days ago: http://news.ycombinator.com/item?id=4999406

This isn't a SQL injection vulnerability at all.

Are you referring to the OP? The OP states:

> There are multiple weaknesses in the parameter parsing code for Ruby on Rails which allows attackers to bypass authentication systems, inject arbitrary SQL, inject and execute arbitrary code, or perform a DoS attack on a Rails application. This vulnerability has been assigned the CVE identifier CVE-2013-0156.

Re: Multiple vulnerabilities in parameter parsing in Action Pack

#13

Post by tptacek » Tue, Jan 08, 2013, 8:29 PM UTC

danso wrote: post #12

tptacek wrote: post #6

Earlier quoted context omitted.

This isn't a SQL injection vulnerability at all.

Are you referring to the OP? The OP states: > There are multiple weaknesses in the parameter parsing code for Ruby on Rails which allows attackers to bypass authentication systems, inject arbitrary SQL, inject and execute arbitrary code, or perform a DoS attack on a Rails application. This vulnerability has been assigned the CVE identifier CVE-2013-0156.

I'm stating direct knowledge of the vulnerability. It's worse than SQL injection.

Re: Multiple vulnerabilities in parameter parsing in Action Pack

#14

Post by sergiotapia » Tue, Jan 08, 2013, 8:29 PM UTC

As a newcomer to the Rails ecosystem all these posts of vunlerabilities and open doors leaves a bad taste in my mouth.

God know I love programming in Ruby now, but is Rails really that insecure?

Re: Multiple vulnerabilities in parameter parsing in Action Pack

#15

Post by jerf » Tue, Jan 08, 2013, 8:30 PM UTC

benmmurphy wrote: post #8

An attacker can execute any ruby code he wants including system("unix command"). This effects any rails version for the last 6 years. I've written POCs for Rails 3.x and Rails 2.x on Ruby 1.9.3, Ruby 1.9.2 and Ruby 1.8.7 and there is no reason to believe this wouldn't work on any Ruby/Rails combination since when the bug has been introduced. The exploit does not depend on code the user has written and will work with…

I don't speak Ruby. Can you or someone else be more precise about where that introduces the vulnerability? (Surely it isn't that YAML::load(content) can run arbitrary shell code?)

Re: Multiple vulnerabilities in parameter parsing in Action Pack

#16

Post by tenderlove » Tue, Jan 08, 2013, 8:30 PM UTC

I'm just commenting here so that people can have a central thread for love / hatred. ;-)

But seriously. This is extremely critical, please upgrade!

Re: Multiple vulnerabilities in parameter parsing in Action Pack

#17

Post by tptacek » Tue, Jan 08, 2013, 8:31 PM UTC

jerf wrote: post #15

benmmurphy wrote: post #8

An attacker can execute any ruby code he wants including system("unix command"). This effects any rails version for the last 6 years. I've written POCs for Rails 3.x and Rails 2.x on Ruby 1.9.3, Ruby 1.9.2 and Ruby 1.8.7 and there is no reason to believe this wouldn't work on any Ruby/Rails combination since when the bug has been introduced. The exploit does not depend on code the user has written and will work with…

I don't speak Ruby. Can you or someone else be more precise about where that introduces the vulnerability? (Surely it isn't that YAML::load(content) can run arbitrary shell code?)

Calling YAML::load on attacker-controlled content in a Ruby app of any complexity is very bad news. As Ben and 'judofyr said: this is remote code execution.

Re: Multiple vulnerabilities in parameter parsing in Action Pack

#18

Post by joevandyk » Tue, Jan 08, 2013, 8:31 PM UTC

tptacek wrote: post #6

danso wrote: post #5

Before anyone wonders if they're having deja vu, this is different than the SQL injection vulnerability that was discussed 5 days ago: http://news.ycombinator.com/item?id=4999406

This isn't a SQL injection vulnerability at all.

But you can use this to trigger the earlier SQL injection vulnerabilities, right?

Re: Multiple vulnerabilities in parameter parsing in Action Pack

#19

Post by tptacek » Tue, Jan 08, 2013, 8:32 PM UTC

joevandyk wrote: post #18

tptacek wrote: post #6

Earlier quoted context omitted.

This isn't a SQL injection vulnerability at all.

But you can use this to trigger the earlier SQL injection vulnerabilities, right?

Yes.

Re: Multiple vulnerabilities in parameter parsing in Action Pack

#20

Post by benmmurphy » Tue, Jan 08, 2013, 8:32 PM UTC

This vulnerability is also present in other other Ruby libraries. I would advise anyone to do bundle install --deployment in there development environment then 'grep -r "YAML::load"' and 'grep -r "YAML.load"' in the vendor/bundle directory. If you have YAML::load(user_controlled_value) or YAML.load(user_controlled_value) then you might be vulnerable to remote code execution. There are some other ruby libraries that are vulnerable to this attack but I don't want to post about them until their authors have fixed them.