3 ms·

To clarify this isn't Mongo's BSON, it's Moped's implementation of BSON/Ruby's implementation of BSON (again). The title is fairly misleading making it sound li

by gabeio 11y ago

To clarify this isn't Mongo's BSON, it's Moped's implementation of BSON/Ruby's implementation of BSON (again). The title is fairly misleading making it sound like it's actually Mongo which is vulnerable. Still interesting stuff though.

rsutphin 11y ago
The article describes how this problem was present in Moped's BSON implementation, then fixed. Then later, Moped replaced its own BSON implementation with BSON-ruby, which had a version of the method which was not vulnerable. Later still, BSON-ruby's method was changed, making it vulnerable. BSON-ruby is, AFAICT, the official BSON library for ruby from Mongo. As I understand it, the vulnerability is in any ruby application which uses a vulnerable version of the bson gem and which accepts object IDs from user input. You don't have to be using Moped.
- deleted 11y ago
  [deleted]
mbell 11y ago
This is not correct. The vulnerability is in `bson-ruby`[1] which is written by MongoDB and used by Moped (and thus Mongoid), the official Ruby driver from MongoDB, and Mongo Mapper. The only thing that _isn't_ vulnerable is Moped's BSON implementation (if reasonably recent), but it was dropped in Moped 2.x. In reality if your using Mongo with Ruby, your most likely vulnerable, unless you happen to be on Moped 1.x. [1] https://github.com/mongodb/bson-ruby/blob/84d8acd32ce9067ad646755e52f472a6ad685918/lib/bson/object_id.rb#L285 https://github.com/mongodb/bson-ruby/blob/84d8acd32ce9067ad6...
- gabeio 11y ago
  > This is not correct. > The vulnerability is in `bson-ruby`[1] which is written by MongoDB and used by Moped (and thus Mongoid), the official Ruby driver from MongoDB, and Mongo Mapper. Then it's in the ruby gem of MongoDB's driver for ruby NOT in MongoDB. The title is still misleading for people who do not code in ruby and therefore are not vulnerable to the apparently ever present ruby BSON bug. > Mongo BSON Injection A better title would be Mongo gem BSON Injection I am not trying to nit-pic I was fairly confused when seeing the title because I don't code in ruby and was 99% sure Mongo's core was C not ruby.
  - lvh 11y ago
    This doesn't detract from your point, but Mongo is primarily C++, not C.
  - homakov 11y ago
    It's the title - I'm using the minimal number of words to carry the idea.
- deleted 11y ago
  [deleted]

by gabeio 11y ago

rsutphin 11y ago

The article describes how this problem was present in Moped's BSON implementation, then fixed. Then later, Moped replaced its own BSON implementation with BSON-ruby, which had a version of the method which was not vulnerable. Later still, BSON-ruby's method was changed, making it vulnerable. BSON-ruby is, AFAICT, the official BSON library for ruby from Mongo. As I understand it, the vulnerability is in any ruby application which uses a vulnerable version of the bson gem and which accepts object IDs from user input. You don't have to be using Moped.

deleted 11y ago
[deleted]

mbell 11y ago

This is not correct. The vulnerability is in `bson-ruby`[1] which is written by MongoDB and used by Moped (and thus Mongoid), the official Ruby driver from MongoDB, and Mongo Mapper. The only thing that _isn't_ vulnerable is Moped's BSON implementation (if reasonably recent), but it was dropped in Moped 2.x. In reality if your using Mongo with Ruby, your most likely vulnerable, unless you happen to be on Moped 1.x. [1] https://github.com/mongodb/bson-ruby/blob/84d8acd32ce9067ad646755e52f472a6ad685918/lib/bson/object_id.rb#L285 https://github.com/mongodb/bson-ruby/blob/84d8acd32ce9067ad6...

gabeio 11y ago
> This is not correct. > The vulnerability is in `bson-ruby`[1] which is written by MongoDB and used by Moped (and thus Mongoid), the official Ruby driver from MongoDB, and Mongo Mapper. Then it's in the ruby gem of MongoDB's driver for ruby NOT in MongoDB. The title is still misleading for people who do not code in ruby and therefore are not vulnerable to the apparently ever present ruby BSON bug. > Mongo BSON Injection A better title would be Mongo gem BSON Injection I am not trying to nit-pic I was fairly confused when seeing the title because I don't code in ruby and was 99% sure Mongo's core was C not ruby.
- lvh 11y ago
  This doesn't detract from your point, but Mongo is primarily C++, not C.
- homakov 11y ago
  It's the title - I'm using the minimal number of words to carry the idea.
deleted 11y ago
[deleted]