81–90 of 183 posts
This quote caught my attention: There are many developers who are not presently active on a Ruby on Rails project who nonetheless have a vulnerable Rails application running on localhost:3000. If they do, eventually, their local machine will be compromised. (Any page on the Internet which serves Javascript can, currently, root your Macbook if it is running an out-of-date Rails on it. No, it does not matter that the I…
Why are you running Rails as the root user? This is a bad idea.
EDIT: I'm not really into client-side JavaScript these days, but when did browsers start allowing JavaScript to connect to anything except the server from which it came? That would be yet another Bad Idea.
Earlier quoted context omitted.
So if I had told you at Christmas three salient facts: + Some objects are unsafe to instantiate if you don't pick all values you initialize them with very carefully. + YAML can instantiate objects from any class. + Rails uses YAML, in a lot of ways. You might have said "Yes, I am aware of all these three things. Do you have anything important to tell me?" Now, if I demonstrate to you working PoC code which combines t…
Anyone competent would, when knowing those three things, immediately think of the possible exploits.
Yes, it's super easy to call everyone involved with the YAML library incompetent, but let's be honest - they're not, in general. They fucked up here, and hindsight is 20/20, but I think it's only face-stabbingly obvious now because of what's actually happened.
This quote caught my attention: There are many developers who are not presently active on a Ruby on Rails project who nonetheless have a vulnerable Rails application running on localhost:3000. If they do, eventually, their local machine will be compromised. (Any page on the Internet which serves Javascript can, currently, root your Macbook if it is running an out-of-date Rails on it. No, it does not matter that the I…
Note: From a sysadmin standpoint http://localhost:3000 commonly refers to http://127.0.0.1:3000 . When running "rails server" locally in development mode, you actually get http://0.0.0.0:3000 . These are not the same! 127.0.0.1 means that "rails server" can only be accessed from your local machine, where 0.0.0.0 means, it can be accessed on any address your computer is listening on. If you are on a local intranet, sa…
This quote caught my attention: There are many developers who are not presently active on a Ruby on Rails project who nonetheless have a vulnerable Rails application running on localhost:3000. If they do, eventually, their local machine will be compromised. (Any page on the Internet which serves Javascript can, currently, root your Macbook if it is running an out-of-date Rails on it. No, it does not matter that the I…
Wouldn't the same origin policy prevent requests to localhost?
This quote caught my attention: There are many developers who are not presently active on a Ruby on Rails project who nonetheless have a vulnerable Rails application running on localhost:3000. If they do, eventually, their local machine will be compromised. (Any page on the Internet which serves Javascript can, currently, root your Macbook if it is running an out-of-date Rails on it. No, it does not matter that the I…
Wouldn't the same origin policy prevent requests to localhost?
Earlier quoted context omitted.
Note: From a sysadmin standpoint http://localhost:3000 commonly refers to http://127.0.0.1:3000 . When running "rails server" locally in development mode, you actually get http://0.0.0.0:3000 . These are not the same! 127.0.0.1 means that "rails server" can only be accessed from your local machine, where 0.0.0.0 means, it can be accessed on any address your computer is listening on. If you are on a local intranet, sa…
Again, even if your development box is being physically protected by the Swiss guard with a firewall that sprung from Donald Knuths' forehead with the River Styx separating it from all inbound connection attempts, it won't even matter , because you run a browser on your development box, that browser can always connect to your development box, and that browser can be instructed to pass malicious input to your developm…
"Any page on the Internet which serves Javascript can, currently, root your Macbook if it is running an out-of-date Rails on it." Why are you running Rails as the root user? This is a bad idea. EDIT: I'm not really into client-side JavaScript these days, but when did browsers start allowing JavaScript to connect to anything except the server from which it came? That would be yet another Bad Idea.