4 ms·
You are providing a valuable service, but is Metasploit really necessary for this? I think this is a simpler command: 'grep rails Gemfile.lock' If you don't s
by nimblegorilla 14y ago
You are providing a valuable service, but is Metasploit really necessary for this? I think this is a simpler command:
'grep rails Gemfile.lock'
If you don't see a rails version of 3.2.1, 3.1.10, 3.0.19, or 2.3.15 then you are vulnerable. Yes?
I guess in theory an attacker could have compromised your server and changed the rails version number...
- ainsleyb 14y agoThere are other workarounds, too. You could disable XML parameter parsing, for example (as seen here: https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/61bkgvnSGTQ https://groups.google.com/forum/?fromgroups=#!topic/rubyonra...). Thus, you might be running an old version, but still actually be safe by disabling the vulnerable bits.
- px43 14y agoWe use old rails, but not the affected activerecord components. Also, there are more yaml bugs in existence than the ones publicly talked about, and this would detect those issues as well.
- ef4 14y ago3.2.1 is not safe (you probably meant 3.2.11) 3.0.19 is not safe (3.0.20 was released to fix CVE-2013-0333) 2.3.15 is not safe (2.3.16 was released to fix CVE-2013-0333)
- nimblegorilla 14y agoGood point. I just copied the version numbers from the linked website - I guess it was outdated. Although I checked again and they are correct now.
- lucian1900 14y agoA smart attacker would install a backdoor and update rails.
- rst 14y agoRails 2.x apps aren't necessarily using Bundler at all, and some folks may have disabled the vulnerable parsers, or installed the security patches only into an earlier version to avoid other breaking changes or new deprecations. (Rails-core has gotten better at avoiding this kind of collateral damage from upgrades, but some folks are still gun-shy.) Actually probing the running app really is the only way to be sure.