Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Multiple vulnerabilities in parameter parsing in Action Pack

groups.google.com

Post reply on HN
Print view View original

21–30 of 294 posts

Re: Multiple vulnerabilities in parameter parsing in Action Pack

#21

Post by danso »

joevandyk wrote: post #18
tptacek wrote: post #6

Earlier quoted context omitted.

This isn't a SQL injection vulnerability at all.

But you can use this to trigger the earlier SQL injection vulnerabilities, right?

I think we're all saying the same thing. But this particular vulnerability described in the OP allows SQL injection via a different means than the one I had linked to (from 5 days ago). But yes, it's all SQL injection (and more, in this case).

Re: Multiple vulnerabilities in parameter parsing in Action Pack

#22

Post by judofyr »

jerf wrote: post #15
benmmurphy wrote: post #8

An attacker can execute any ruby code he wants including system("unix command"). This effects any rails version for the last 6 years. I've written POCs for Rails 3.x and Rails 2.x on Ruby 1.9.3, Ruby 1.9.2 and Ruby 1.8.7 and there is no reason to believe this wouldn't work on any Ruby/Rails combination since when the bug has been introduced. The exploit does not depend on code the user has written and will work with…

I don't speak Ruby. Can you or someone else be more precise about where that introduces the vulnerability? (Surely it isn't that YAML::load(content) can run arbitrary shell code?)

I think it's better to not discuss this openly for a few days. The exploit isn't obviously (as you've noticed) so hopefully users will be able to upgrade before the script kiddies discovers this.

Re: Multiple vulnerabilities in parameter parsing in Action Pack

#23

Post by robconery »

sergiotapia wrote: post #14

As a newcomer to the Rails ecosystem all these posts of vunlerabilities and open doors leaves a bad taste in my mouth. God know I love programming in Ruby now, but is Rails really that insecure?

All web frameworks have vulnerabilities - the key is how quickly the team responds. For that, I love Rails (and @tenderlove)

Re: Multiple vulnerabilities in parameter parsing in Action Pack

#25

Post by diminish »

tenderlove wrote: post #16

I'm just commenting here so that people can have a central thread for love / hatred. ;-) But seriously. This is extremely critical, please upgrade!

3 links on HN frontpage for this same vulnerability proves the love of the community to warn each other tenderly.

Re: Multiple vulnerabilities in parameter parsing in Action Pack

#26

Post by jerf »

judofyr wrote: post #22
jerf wrote: post #15

Earlier quoted context omitted.

I don't speak Ruby. Can you or someone else be more precise about where that introduces the vulnerability? (Surely it isn't that YAML::load(content) can run arbitrary shell code?)

I think it's better to not discuss this openly for a few days. The exploit isn't obviously (as you've noticed) so hopefully users will be able to upgrade before the script kiddies discovers this.

Understood, and question withdrawn. Thanks for the answer. I look forward to your future public disclosure. (I mean that sincerely, not as a poke.)

Re: Multiple vulnerabilities in parameter parsing in Action Pack

#30

Post by joevandyk »

tenderlove wrote: post #16

I'm just commenting here so that people can have a central thread for love / hatred. ;-) But seriously. This is extremely critical, please upgrade!

These are the commits that need to be pulled in, right?

https://github.com/rails/rails/commit/d5cd97baa44fa66dc68104...

https://github.com/rails/rails/commit/43109ecb986470ef023a7e...

Are there others?

Post reply on HN