4 ms·
Security Vulnerabilities in Heroku
- danielpal 14y agoWOW this was critical bug, you could basically change anyone password without authenticating and then authenticate as them. I wish heroku would disclose this issues.
- ssclafani 14y agoHeroku will be publishing a blog post sometime today.
- willlll 14y agohttp://blog.heroku.com/archives/2013/1/9/password_hijacking_security_incident_and_response/ http://blog.heroku.com/archives/2013/1/9/password_hijacking_...
- latchkey 14y agoI wish that Heroku would just use a third party open source auth system like Persona. This stuff is difficult and complicated to implement correctly. Sure, Persona could have had this same bug, but I'd rather trust someone who's job all day long is to implement auth systems (and which I can get the source to).
- angkec 14y agofrom the article: "Initial fixes were in place within 24 hours." So it's all fixed? Great! I'll stick with Heroku as my hosting provider like the author does.
- jiggy2011 14y ago"If the POST was made with ID removed from both the URL and body, the password of a random account would be reset and the account automatically logged in to:" That seems like a very strange bug to occur.
- scriby 14y agoThis kind of bug can happen when you have code like this in SQL: SELECT @id = id FROM table --Oops, forgot where clause. This selects a "random" row DELETE FROM table_2 WHERE id = @id
- jiggy2011 14y agoPresumably though the where clause would be there if you are taking the user id from the request vars in order for the code to work at all?
- jstanley 14y agoIf you build the query at runtime based on whichever arguments are available, it is quite easy for missing arguments to slip through to the inner query generator and end up with a blank where clause.
- jiggy2011 14y agoa blank where clause throws an error (in mySQL at least) as it should do. Or will the query generator respond to missing arguments by removing the where clause altogether? In which case that's some pretty nasty behaviour.
- scriby 14y agoDepends on the flavor of SQL. But also, might not be a totally missing where clause, but just an incomplete one.
- tmaher 14y agoIt was actually slightly more dumb than that. Like most sites, after you register your account, we generate a nonce and email it to the provided address. You click the link with the nonce, we prompt you to set your password, and your account is ready. Our bug was that for already-verified users, the nonce column in the database is empty (it's a nonce, you see, so we only use it once...). This was the root cause for both bugs Mr. Sclafani describes.
- darkarmani 14y agoWow. Those are pretty nasty vulnerabilities. Way to responsibly disclose them after working with Heroku!
- tmaher 14y agoHi, our response can be found at... http://blog.heroku.com/archives/2013/1/9/password_hijacking_security_incident_and_response/ http://blog.heroku.com/archives/2013/1/9/password_hijacking_... Thanks again to Stephen for giving us ample time to fix this. -Tom Maher, Heroku Security Team
- jlkinsel 14y agoAlways like to see transparent and timely responses to issues like this. Well done.