10 ms·
Ruby on Rails vulnerable to mass assignment and SQL injection
- peterlih 14y agoGreat job, Thomas!
- lexy0202 14y agoVery good explanation - thanks.
- trevorcreech 14y agoI love building stuff with Rails, but these last few weeks are making me glad I'm not maintaining it in production.
- thelarry 14y agoI get a little chuckle when I tell people I am building some app and they ask "Why aren't you using RoR and MongoDB?" Maybe I am not comfortable with them in production?
- meaty 14y agoI am of the same opinion. Having trialled both extensively, we stuck with asp.net MVC and SQL server. Expensive but well engineered.
- RyanZAG 14y agoWouldn't be so sure of safety - RoR just gets a lot more publicity when a vulnerability surfaces, although the huge amount of magic involved in RoR makes vulnerabilities more common than more static code. http://forums.asp.net/1233.aspx http://forums.asp.net/1233.aspx http://www.troyhunt.com/2012/04/67-of-aspnet-websites-have-serious.html http://www.troyhunt.com/2012/04/67-of-aspnet-websites-have-s... etc Besides, most web app vulnerabilities are coding flaws in the user code itself, and very rarely in the framework.
- Encosia 14y agoThe difference is that things like enabling remote errors or disabling request validation in ASP.NET requires that you explicitly change those settings. The default config doesn't expose either of those issues.
- gregors 14y agoI've got a screen capture with bing showing me remote errors. People do make mistakes.
- meaty 14y agoBing are Microsoft dogfooding new tech. They will make mistakes. For those of us who are conservative there are very few opportunities to make mistakes. We have checklists, security policies, code reviews and even protection components in our framework as well as completely segregated web and back end systems.
- Encosia 14y agoOf course people make mistakes. The point is that the framework doesn't expose you to those risks by default. You have to explicitly make those mistakes yourself. Further, when ASP.NET does have the odd vulnerability crop up, patches roll out automatically as critical updates via Windows Update. So, these things get patched quickly even if the app or server is no longer actively maintained, as is the case with so much code out there on every platform. Ironically, it's a bit like Windows Server is the Google Chrome of server environments when it comes to frequency and pervasiveness of updates.
- meaty 14y agoHowever framework vulnerabilities offer a consistent attack surface which needs little analysis or tailoring. The only vulnerability we've seen (ms11-100) was swiftly dealt with and would have been eaten by our up front load balancers anyway. Regarding our application, our test load is 134,000 test cases and 220,000 lines of assertions. I can sleep well at night.
- gregors 14y agoHope you're not using default model binder, because M$ still allows for you to hang yourself with mass assignment attacks. Something they have yet to learn. Hope you're not running MVC 1 or MVC 2, you're still open to redirection attacks. It's not called patch Tuesday for nothing.
- meaty 14y agoWe have our own model binder implementation (with circuit breakers) and UI framework and are using mvc3. And yes we're always fully patched.
- gregors 14y agoReally that's the point I'm trying to make. The default path in MVC isn't exactly secure. There is work to be done. I'd consider this particular rails update in line with a patch Tuesday update. Though I will say, I wish they had a better way of communicating when updates were available.
- j-kidd 14y agoSQL Server is anything but well engineered. What version of SQL Server are you currently running? Is it on the latest service pack only, or with the latest cumulative update applied? The later fixes critical bugs, but claimed to be "not fully tested" by Microsoft. This retarded release policy means there is no stable version of SQL Server.
- meaty 14y agoI disagree. We're not using the latest patches. We're using an independently verified and tested set of patches. The baseline is 2008.
- nathan_long 14y agoBefore you chuckle, you should be sure that you're doing security better than Rails. Read this and see how your framework or custom code stacks up. http://guides.rubyonrails.org/security.html http://guides.rubyonrails.org/security.html Also, ask yourself: "when I have a security vulnerability, how easy is it to fix?" Fixing a Rails vulnerability and deploying the fix to production takes about 2 minutes.
- Finster 14y agoThis begs the question: Are the Rails devs reading that?
- thelarry 14y agoI am like Dr Hibbert, I chuckle at inappropriate times. But my point was just because something is popular, doesn't mean it is the best for everything. And that you _should_ understand how things work under the hood and not just choose these platforms blindly. I am not specifically hating on RoR, I feel that many developers choose it just because it is easy and popular without understanding what rails gives you and how it works.
- hakaaaaak 14y agoNow imagine if you'd written 10x as much code in Java and hit a Java vulnerability. The U.S. government told its citizens to uninstall Java recently. There have been a few other high profile Java vulnerabilities in the past few years. Does that mean Java is the wrong choice? Most jobs available in development are in Java (check indeed.com). For years Microsoft was the butt of most security jokes. .Net dev jobs are #2 under Java in indeed.com. Find me a well-used platform that hasn't had a massive security hole or a community that hasn't tended to write insecure code at some point.
- X-Istence 14y agoA lot of jobs in Java are not for Java Applets running on peoples machines, a lot of the Java work is for client side apps, and for server side apps (think app development like RoR). Java applets are not necessary. The reason why the US government said to uninstall Java is because it is the quickest and easiest way for the layman to remove the ability for Java applets to run. If Sun^H^H^HOracle provided a way to just install Java so it can be used for client side apps without turning on Java applets in the browser, then it is not any less unsafe than C++/C#/Obj-C apps running on the same system.
- hakaaaaak 14y agoYou missed my point, which was that well-used languages and platforms have vulnerabilities and we still use them. And Java web apps have had security issues too. Do you remember this one? http://www.oracle.com/technetwork/topics/security/alert-cve-2010-4476-305811.html http://www.oracle.com/technetwork/topics/security/alert-cve-...
- X-Istence 14y agoI am not sure I missed your point. I was simply pointing out that people looking for Java developers has nothing to do with the fact that Java's applet stuff is completely vulnerable. Yes, other vulnerabilities exist, and they too had to be patched, I don't think dropping an entire language if a flaw is found is a good idea, we wouldn't be left with any, however Ruby on Rails is a framework built on top of Ruby, that is what contains the issues, not Ruby.
- matthuggins 14y agoGood explanation, but it sounds like there is a second component to the issue that this doesn't address: the fact that user input can be converted to symbols, which will ultimately eat memory as new symbols are created.
- sergiotapia 14y agoAgain? We need a single website alerting RoR devs about vulnerabilities. I shouldn't have to found out about these things on HackerNews. Someone build this website for us RoR devs, pretty please? (ps. use PHP - heh)
- kingnothing 14y agoTwitter works great for this.
- TomasSedovic 14y agoThis is the Ruby on Rails Security mailing list: https://groups.google.com/forum/#!forum/rubyonrails-security https://groups.google.com/forum/#!forum/rubyonrails-security you can view it in the browser but unlike with a vanilla website, you can also receive notifications via an email.
- spencerfry 14y agoHeroku does a good job of notifying its users.
- static_typed 14y agoYou could always wait till the server gets compromised, then the customers could alert you?
- nichols 14y agoActually, that's how security vulnerabilities are normally handled in the Ruby on Rails world. What, you think I'm joking? Think again: http://arstechnica.com/business/2012/03/hacker-commandeers-github-to-prove-vuln-in-ruby/ http://arstechnica.com/business/2012/03/hacker-commandeers-g...
- minikomi 14y agoSounds like a RoR bat-signal!
- jiggy2011 14y agoHow do you guys who are freelancers or perhaps you work for a company and are the only guy working on a particular app handle security stuff like this? A lot of what I hear is "drop what you are doing and patch this right now!". But of course there are many reasons why this might not be possible. For example you might be on a 15 hour flight with no internet, you might be dealing with some family crisis, you might be in the middle of a coke and sex binge with identical twins who look like Scarlett Johansen or whatever. Do you live glued to your smartphone in constant fear of 0 days? Do you make sure there is some third party available to deal with this stuff? do you design with the possibility of having your app/site owned as a likely event? And how do you make your client/employer aware of the implications of stuff like this?
- static_typed 14y agoWe actually moved off Ruby/Rails because of all this, but previously it was a test in QA, then patch Prod, both on same day of the word hitting the street that there was yet another hole to close
- charliesome 14y agoWhat are you going to do when whatever you're currently using has a security problem? Moving off Rails is not a panacea
- mpyne 14y agoIt doesn't have to be a panacea, it just has to significantly reduce the risk of being exploited (whether due to superior design philosophy, superior execution of that design philosophy, or simply 'security by low market share'). If the security of your platform depends on that platform not become a popular target of hacker attention then sometimes it really is as simple as "I don't need to outrun the bear; I just need to outrun you"
- jiggy2011 14y agoThis is an odd way to think. What happens if you start on a niche platform and it gets popular, do you switch? Just because a platform is small doesn't mean somebody isn't going to try and bust it and when they do the small project may not have the resources to push out a robust fix quickly.
- chc 14y agoBefore anybody gets the wrong idea here: Yes, there are a lot of highly publicized Rails vulnerabilities lately. If you avoid Rails, it will protect you from these vulnerabilities. But give somebody familiar with pentesting a little while with your app and I rather strongly suspect they will find new and different vulnerabilities that would horrify you as much as anything you find in Rails. Rails gets a lot of scrutiny. Just because your ad hoc Flask app doesn't does not mean it would hold up a lot better. If you believe it will, think very hard about the reasons. (This is not to say you shouldn't use something else either — just that the gut instinct of "Well, my app on this little microframework won't be getting security advisories every couple of weeks" is not necessarily something you want to follow. Like I said, think very hard about whether you really believe you can do justice to your app better than the Rails security team. And read up on some anecdotes from people who do application security while you're thinking about it, because I find people tend to underestimate just how broken most software is.)
- saurik 14y agoI agree with you; however, there is something to be said for "not subject to drive-by mass tagetings on short notice" that is ignored by this argument. There may be 7 obvious bug in your program, but of you have a couple hundred users, will any of them bother? However, even if you have no users at all, you are going to get hacked by these 0-days due to people just scanning the Internet looking for vulnerable systems. In my case, every single time I've been hacked has been due to a 0-day dropping that I didn't pay enough attention to (like exim4), as opposed to the assuredly infinate number of bugs I have in my own software.
- chc 14y agoThat's true, and there's something to be said for that, though I'm ambivalent about exactly what that something is. That's part of why I tried to make it clear that my point was "Don't knee-jerk on this" rather than "You must stick with Rails or you are a fool." I'm not going to preach security practices at people — there are people much better qualified to do that — I just want people to make sure they understand what tradeoffs they're making with whatever decision they make. A lot of people have drastic misconceptions about these sorts of things. If you're intending to have a little site that largely depends on security through obscurity not to get owned, you should at least know that.
- tomkin 14y agoI wonder what DHH has to say about all of this? I seem to remember a few of his posts being pretty harsh on security and security of other platforms. I can't imagine DHH completely washes his hands of these vulnerabilities?
- rednukleus 14y agohttps://twitter.com/dhh/status/289669574427820032 https://twitter.com/dhh/status/289669574427820032 This was his reaction last time there were posts on HN about security vulnerabilities in Rails.
- tomkin 14y agoFunny he calls HN a cesspool, "It appears that HN is following the law of large communities: they go to shit." [1] – using Twitter, a community of millions. Plus, he has posted here as recently as 10 days ago. :D [1] https://twitter.com/dhh/status/289728046230028288 https://twitter.com/dhh/status/289728046230028288