4 ms·

Correct me if I'm wrong but this wasn't a "zero day". This issue was brought up four days ago https://github.com/rails/rails/issues/5228 https://github.com/rail

• trotsky 15y ago
  I thought there were two different issues, though not being a rails jockey I could easily be mistaken. Even if it was disclosed four days before it was exploited I stand by my take if not my terminology.
  • masklinn 15y ago
    > I thought there were two different issues Nope, this bug is exactly what he used for his demonstration (and there are warnings about attr_accessible going back 3 or 4 years, so it's not a "0-day" by most accounts, more of a "3-years"" vuln)
    • deleted 15y ago
      [deleted]
• acqq 15y ago
  Yes, it's the very known issue made public long ago on a lot of serious places, for example: "Weapons of Mass Assignment" by Patrick McKenzie, ACM Queue, March 2011 http://queue.acm.org/detail.cfm?id=1964843 http://queue.acm.org/detail.cfm?id=1964843 Worse, ten years ago PHP changed the default behavior after suffering from very similar problem: http://www.sitepoint.com/write-secure-scripts-php-4-2/ http://www.sitepoint.com/write-secure-scripts-php-4-2/ Rails actually needed Egor to initiate change. At first they ignored him: https://github.com/rails/rails/issues/5228 https://github.com/rails/rails/issues/5228 Now the change can be seen: http://news.ycombinator.com/item?id=3664459 http://news.ycombinator.com/item?id=3664459