Ruby on Rails vulnerable to mass assignment and SQL injection

zweitag.de 11 Feb '13, 6pm

Ruby on Rails vulnerable to mass assignment and SQL injection

Ruby on Rails vulnerable to mass assignment and SQL injection During the last weeks Ruby on Rails has been hit by several security vulnerabilites. As with all bigger open source projects, it is up to the community to spot and fix such issues. Last week I notified the Ruby on Rails security team about a huge vulnerability that I spotted in the latest stable release of Rails and its related gems. As a result the Rails core team published a security advisory today, urging users to upgrade the json gem to the latest stable release. Here’s the gist: The default JSON parser can be used to inject malicious objects into the params hash of a Rails application. This allows for tampering with ActiveRecord::Base functionality like dynamic finders and attribute assignment, eventually leading to mass assignment of blacklisted attributes or even SQL injection. Besides deserializing simpl...

Full article: http://www.zweitag.de/en/blog/ruby-on-rails-vulnerable-to...

Tweets

@amzurtech » 22 Feb '13, 4pm
@zweitag shares an interesting article on how #Rails apps are vulnerable to mass assignment and #SQL injection [link]
@netsecured99 » 19 Feb '13, 9pm
RT @Smitticus2013Ruby on Rails vulnerable to mass assignment and #SQL injection [link] #Tech #IT #Security #web #CIO: R...
@Smitticus » 19 Feb '13, 8pm
Ruby on Rails vulnerable to mass assignment and #SQL injection [link] #Tech #IT #Security #web #CIO
@HatemMahmoud » 19 Feb '13, 12pm
Ruby on Rails vulnerable to mass-assignment and SQL injection [link]
@flatstack » 18 Feb '13, 10pm
Ruby on Rails vulnerable to mass assignment and SQL injection [link] via @zweita
@gncvalente » 15 Feb '13, 3pm
Are Rails 3.2.11 apps still at risk? [link]
@TRUNASUCI » 15 Feb '13, 5am
RT @vuln_: #CVE-2013-0269 Ruby json Gem Document Parsing Vulnerability [link] https://t.co/ODsQm8c4 [link]
@SalamancaPeral » 14 Feb '13, 9pm
Gracias por actualizarme Julien! Aprendo mil!!  RT “@__juju__: @SalamancaPeral pues como te interesa, [link] :)”
@__juju__ » 14 Feb '13, 8pm
@SalamancaPeral pues como te interesa, [link] :)
@tmayr » 14 Feb '13, 3pm
@M_kmpus [link] :D!
@iMagesh » 14 Feb '13, 3pm
Update 'json' gem to avoid mass assignment & SQL injection #Rails [link]
@Mark_DuBois » 13 Feb '13, 10pm
“@mrpaladin: Recent : ruby security weakness #ruby [link] #in” <= updates are important
@mrpaladin » 13 Feb '13, 10pm
Recent : ruby security weakness #ruby [link] #in
@fmonbillard » 13 Feb '13, 3pm
your #ruby on #rails app vulnerable to mass assignment and SQL injection. Gentlemen, upgrade your #rails app ! Now ! [link]
@mrpaladin » 13 Feb '13, 3pm
Discovered : ruby vulnerability flaw #security [link]
@vuln_ » 13 Feb '13, 8am
#CVE-2013-0269 Ruby json Gem Document Parsing Vulnerability [link] https://t.co/kOEauGXm [link]
@CookyDoh » 13 Feb '13, 5am
RT @hariflute: RoR vulnerable to mass assignment and SQL injection - [link]
@presidentbeef » 12 Feb '13, 10pm
Rails CVE-2013-0269 was not JUST symbol DoS, depending on json/json_pure gem version. Please read [link] from @Tho85
@theologu » 12 Feb '13, 10pm
Ruby on Rails vulnerable to mass assignement and sql injection [link]
@jermops » 12 Feb '13, 6pm
lock up your Rails: [link]
@benjamin_ds » 12 Feb '13, 6pm
RT @phollow: Yes, again. Ruby on Rails vulnerable to mass assignment and SQL injection [link]
@phollow » 12 Feb '13, 6pm
Yes, again. Ruby on Rails vulnerable to mass assignment and SQL injection [link]
@haiqus » 12 Feb '13, 2pm
another! [link]
@netsecured99 » 12 Feb '13, 2pm
RT @ThatDBell2013Ruby on Rails vulnerable to mass assignment and SQL injection [link] #security #ruby #exploit: Ruby on...
@ThatDBell » 12 Feb '13, 2pm
Ruby on Rails vulnerable to mass assignment and SQL injection [link] #security #ruby #exploit
@netsecured99 » 12 Feb '13, 1pm
RT @fanf2013[link] - Ruby on Rails json_class vulnerability.: [link] - Ruby on Rails json_class vulnerability.
@simonemartelli » 12 Feb '13, 12pm
RT @spleenteo: Ruby on Rails vulnerable to mass assignment and SQL injection [link] check your app
@nidi » 12 Feb '13, 12pm
RT @codingluke: @Tho85 @zweitag Glad to work with excellent people. +1 for your catch. [link]
@herder » 12 Feb '13, 11am
Ruby on Rails vulnerable to mass assignment and SQL injection - [link] via @Shareaholic #ruby #rails
@codingluke » 12 Feb '13, 11am
@Tho85 @zweitag Glad to work with excellent people. +1 for your catch. [link]
@mikeeeeeeey » 12 Feb '13, 11am
@samjbmason nice one - watch yourself though, heard there's apparently a lot of security issues with RoR at the moment! [link]
@naneau » 12 Feb '13, 10am
Yet another RoR vuln? [link]
@leosoto » 12 Feb '13, 10am
RT @simonw: The "json_class" magic key feature in the Ruby JSON parser is nuts - unsurprisingly it's also a security hole :/ [link]
@netsecured99 » 12 Feb '13, 10am
RT @thorlarholm2013New Rails vulnerability, mass assignment and SQL injection, [link] #ruby #rails #security: New Rails...
@fabeeoo » 12 Feb '13, 10am
@pantulis sql injections used to be a php thing right :)? [link] #ror #php #sql
@thepoettrap » 12 Feb '13, 10am
RT @joshuadarnell: Ruby on Rails vulnerable to mass assignment and SQL injection [x-post from r/rails] [link]
@erlihs » 12 Feb '13, 10am
RT @agris_krusts: Kārtējais "caurums" Ruby on Rails. Pēdējā laikā bieži tie parādās šajā vidē - [link]
@simonw » 12 Feb '13, 9am
The "json_class" magic key feature in the Ruby JSON parser is nuts - unsurprisingly it's also a security hole :/ [link]
@zweitag » 12 Feb '13, 9am
hehe :-) RT @Hypn @iFrankZA yeah :D we have a german intern (Jan) with us atm, from the company that found this one: [link]
@AndrewJacksonZA » 12 Feb '13, 8am
RT @Phil_Factor: Ruby on Rails vulnerable to mass assignment and SQL injection [link] Crikey, Ruby on Rails is full of holes!
@netsecured99 » 12 Feb '13, 8am
RT @Phil_Factor2013Ruby on Rails vulnerable to mass assignment and SQL injection [link] Crikey, Ruby on Rails is full o...
@netsecured99 » 12 Feb '13, 8am
RT @spleenteo2013Ruby on Rails vulnerable to mass assignment and SQL injection [link] check your app: Ruby on Rails vul...
@Hypn » 12 Feb '13, 8am
@iFrankZA yeah :D we have a german intern (Jan) with us atm, from the company that found this one: [link]
@agris_krusts » 12 Feb '13, 8am
Kārtējais "caurums" Ruby on Rails. Pēdējā laikā bieži tie parādās šajā vidē - [link]
@Phil_Factor » 12 Feb '13, 7am
Ruby on Rails vulnerable to mass assignment and SQL injection [link] Crikey, Ruby on Rails is full of holes!
@spleenteo » 12 Feb '13, 7am
Ruby on Rails vulnerable to mass assignment and SQL injection [link] check your app
@nmonkee » 12 Feb '13, 7am
RT @publidave: reportedly a new rails issue but the site is down... cmoooon [link]
@netsecured99 » 12 Feb '13, 6am
RT @robertklep2013Ruby on Rails vulnerable to mass assignment and SQL injection [link] (#DigID down again in 3, 2, 1......
@dominucco » 12 Feb '13, 6am
And the beat goes on #rails [link]
@robertklep » 12 Feb '13, 6am
Ruby on Rails vulnerable to mass assignment and SQL injection [link] (#DigID down again in 3, 2, 1...)