ModSecurity Mitigations for Ruby on Rails XML Exploits

ModSecurity Mitigations for Ruby on Rails XML Exploits - SpiderLabs Anterior

ModSecurity Mitigations for Ruby on Rails XML Exploits

There is big trouble in Ruby on Rails (RoR) land... The issue is related to XML parsing of YAML document elements or Symbols and results in remote code execution. The vulnerabilities have been confirmed by multiple sources and proof of concept code is available: Rails PoC Exploits by Postmortem . ModSecurity Mitigations The primary recommendation is of course to update your Ruby on Rails code to the latest patched version. If, however, you are unable to do so in a timely manner or at all, then here are some options to use ModSecurity to help prevent these attacks. Activating the XML Request Body Parser (libxml2) ModSecurity has the ability to inspect XML request bodies using libxml2 however it will not do so automatically. You must use rules to activate the XML request body parser. The OWASP ModSecurity CRS has the following example rule withn the 10 setup file : # # -- [[...

Full article: http://blog.spiderlabs.com/2013/01/modsecurity-mitigation...

Tweets

@ryancbarnett » 09 Feb '13, 12am
@ndm @talltroym @rbates ModSecurity WAF is a web server module (Apache, IIS7 & Nginx) [link]
@jeffrafter » 02 Feb '13, 8pm
It looks like @modsecurity is way ahead of me: [link]
@ModSecurity » 02 Feb '13, 1pm
@jeffrafter @seanhussey [link]
@ndm » 30 Jan '13, 7pm
Oh @ryancbarnett was all over my previous WAF comment… 3 weeks ago: [link]
@ryancbarnett » 30 Jan '13, 6pm
@ndm @xternal already done - [link]
@ryancbarnett » 29 Jan '13, 7pm
Due to the latest RoR vuln, retweeting this blog post: [link]
@mprokopov » 14 Jan '13, 10pm
ну а самые умные могут запатчить свои рельсы через apache или nginx + mod_security [link]
@logosity » 13 Jan '13, 6pm
#rails #xml #security ~ RT @abedra: For those of you who haven't patched yet. [link]
@abedra » 13 Jan '13, 6pm
For those of you who haven't patched yet. [link]
@PeterMAbraham » 11 Jan '13, 7pm
ModSecurity Mitigations for Ruby on Rails XML Exploits [link] #security #infosec #itsec
@lbhuston » 11 Jan '13, 3pm
Trustwave has some mod_security ideas for helping the Rails issue if you can't patch. [link]
@mivesto » 11 Jan '13, 2pm
RT @antisnatchor: “@ModSecurity: ModSecurity Mitigations for Ruby on Rails XML Exploits [link]” < interesting /cc @ryancbarnett
@antisnatchor » 11 Jan '13, 2pm
“@ModSecurity: ModSecurity Mitigations for Ruby on Rails XML Exploits [link]” < interesting /cc @ryancbarnett
@cudeso » 11 Jan '13, 7am
RT @lferette: Using Ruby on Rails? Put modsecurity in front and read this post [link]
@lferette » 11 Jan '13, 7am
Using Ruby on Rails? Put modsecurity in front and read this post [link]
@hysterka » 11 Jan '13, 7am
ModSecurity Mitigations for Ruby on Rails exploit [link] (via @matteoca)
@LaNMaSteR53 » 11 Jan '13, 6am
RT @ubersec: ModSecurity Mitigations for Ruby on Rails XML Exploits [link] @SpiderLabs @Trustwave
@ubersec » 11 Jan '13, 5am
ModSecurity Mitigations for Ruby on Rails XML Exploits [link] @SpiderLabs @Trustwave
@devteev » 11 Jan '13, 4am
RT @Hfuhs: ModSecurity Mitigations for Ruby on Rails XML Exploits - [link]
@matteoca » 10 Jan '13, 9pm
ModSecurity Mitigations for Ruby on Rails exploit [link]
@neoCrimeLabs » 10 Jan '13, 7pm
ModSecurity rules to mitigate the latest Rails XML vulnerability: [link]
@brokencode » 10 Jan '13, 7pm
RT @binushacker: #Research ModSecurity Mitigations for Ruby on Rails XML Exploits [link] #Technology #Hacking
@binushacker » 10 Jan '13, 7pm
#Research ModSecurity Mitigations for Ruby on Rails XML Exploits [link] #Technology #Hacking
@ndm » 10 Jan '13, 6pm
ModSecurity mitigations for recent Rails XML/YAML CVE(s) [link] from @ryancbarnett
@Glesec » 10 Jan '13, 6pm
ModSecurity Mitigations for Ruby on Rails XML #Exploits | SpiderLabs Anterior [link] #RoR
@ryancbarnett » 10 Jan '13, 6pm
RT @ModSecurity: ModSecurity Mitigations for Ruby on Rails XML Exploits [link]
@ModSecurity » 10 Jan '13, 6pm
ModSecurity Mitigations for Ruby on Rails XML Exploits [link]
@nopsec » 10 Jan '13, 6pm
RT @ModSecurity: ModSecurity Mitigations for Ruby on Rails XML Exploits [link]
@flaviog33k » 10 Jan '13, 6pm
RT @ModSecurity: ModSecurity Mitigations for Ruby on Rails XML Exploits [link]
@AlanJumpi » 10 Jan '13, 6pm
RT @ModSecurity: ModSecurity Mitigations for Ruby on Rails XML Exploits [link]
@spookerlabs » 10 Jan '13, 6pm
RT @ModSecurity: ModSecurity Mitigations for Ruby on Rails XML Exploits [link]
@n3tg33k » 10 Jan '13, 6pm
RT @ModSecurity: ModSecurity Mitigations for Ruby on Rails XML Exploits [link]
@sinusgear » 10 Jan '13, 6pm
RT @ModSecurity: ModSecurity Mitigations for Ruby on Rails XML Exploits [link]