Multiple vulnerabilities in parameter parsing in Action Pack

#1

Post by jfirebaugh » Tue, Jan 08, 2013, 8:18 PM UTC

Multiple vulnerabilities in parameter parsing in Action Pack
groups.google.com

Re: Multiple vulnerabilities in parameter parsing in Action Pack

#2

Post by steveklabnik » Tue, Jan 08, 2013, 8:20 PM UTC

To emphasize:

    > Due to the critical nature of this vulnerability, and the fact that portions
    > of it have been disclosed publicly, all users running an affected release
    > should either upgrade or use one of the work arounds *immediately*.

Re: Multiple vulnerabilities in parameter parsing in Action Pack

#3

Post by tptacek » Tue, Jan 08, 2013, 8:21 PM UTC

Patch right now.

Re: Multiple vulnerabilities in parameter parsing in Action Pack

#4

Post by judofyr » Tue, Jan 08, 2013, 8:21 PM UTC

This is bad, bad, bad, bad! SQL injections, remote code execution, DoS. Pretty much everything is possible with this exploit. You don't even need the secret key which was required in the previous vulnerability.

Upgrade NOW.

Re: Multiple vulnerabilities in parameter parsing in Action Pack

#5

Post by danso » Tue, Jan 08, 2013, 8:24 PM UTC

Before anyone wonders if they're having deja vu, this is different than the SQL injection vulnerability that was discussed 5 days ago:

http://news.ycombinator.com/item?id=4999406

Re: Multiple vulnerabilities in parameter parsing in Action Pack

#6

Post by tptacek » Tue, Jan 08, 2013, 8:25 PM UTC

danso wrote: post #5

Before anyone wonders if they're having deja vu, this is different than the SQL injection vulnerability that was discussed 5 days ago: http://news.ycombinator.com/item?id=4999406

This isn't a SQL injection vulnerability at all.

Re: Multiple vulnerabilities in parameter parsing in Action Pack

#7

Post by batgaijin » Tue, Jan 08, 2013, 8:25 PM UTC

At least people are getting practice at following security bulletins.

Re: Multiple vulnerabilities in parameter parsing in Action Pack

#8

Post by benmmurphy » Tue, Jan 08, 2013, 8:25 PM UTC

An attacker can execute any ruby code he wants including system("unix command"). This effects any rails version for the last 6 years. I've written POCs for Rails 3.x and Rails 2.x on Ruby 1.9.3, Ruby 1.9.2 and Ruby 1.8.7 and there is no reason to believe this wouldn't work on any Ruby/Rails combination since when the bug has been introduced. The exploit does not depend on code the user has written and will work with a new rails application without any controllers.

Here is the commit where it was introduced: https://github.com/rails/rails/commit/27ba5edef1c4264a8d1c0e...

Re: Multiple vulnerabilities in parameter parsing in Action Pack

#9

Post by tptacek » Tue, Jan 08, 2013, 8:26 PM UTC

benmmurphy wrote: post #8

An attacker can execute any ruby code he wants including system("unix command"). This effects any rails version for the last 6 years. I've written POCs for Rails 3.x and Rails 2.x on Ruby 1.9.3, Ruby 1.9.2 and Ruby 1.8.7 and there is no reason to believe this wouldn't work on any Ruby/Rails combination since when the bug has been introduced. The exploit does not depend on code the user has written and will work with…

I can confirm most of what Ben says directly. What I can't confirm, I can't confirm only because Ben is smarter than me about this stuff.

Re: Multiple vulnerabilities in parameter parsing in Action Pack

#10

Post by 10char » Tue, Jan 08, 2013, 8:27 PM UTC

Correct me if I'm wrong, but looks like this should only be a vulnerability if your app uses XML parameters?