Vulnerabilities / Threats
1/10/2013
03:49 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Attack Code, Metasploit Module Released For Serious Ruby On Rails Bugs

Drop everything and patch Ruby on Rails apps now, security experts say

This just got (more) real: Researchers today unleashed exploit code for a pair of newly found vulnerabilities in the popular Web application programming platform Ruby on Rails (RoR), as well as a new Metasploit module for the most serious of the two flaws, raising concerns of potentially damaging attacks to come on Web servers and databases.

Patches for the two Ruby on Rails vulnerabilities, CVE-2013-0155 and CVE-2013-0156, were issued yesterday after researchers disclosed the bugs earlier this week. Ruby on Rails is an open-source Web programming framework that runs in more than 200,000 websites and on tens of thousands of apps, including Twitter, Metasploit, Groupon, Scribd, Hulu, Living Social, Yellow Pages, and GitHub.

To date, RoR hasn't experienced much in the way of security vulnerability issues, but this new bug finds likely will open the floodgates for more research into holes -- and attacks, security experts say.

Most worrisome is the CVE-2013-0156 bug, which would allow an attacker to execute code remotely on any RoR application that has the XML parser enabled, which is a default setting. The attacker could then steal data from the back-end database, as well as poison the application or website with backdoors and water-hole attacks.

"It's pretty bad," says HD Moore, chief architect of the Metasploit Project, which had to patch its own software for the flaws yesterday. Moore says it's not just the 200,000 sites running on RoR, but also a "huge number of products" running on it that need to be patched.

Moore and his team found themselves in the strange position of having to patch for a flaw that they would then weaponize with an RoR exploit in Metasploit. "Everyone missed it -- our internal and external coders," Moore says of the RoR bugs in Metasploit.

While there were no known attacks as of this posting, security experts still worry that organizations with fewer resources or knowledge of what they have running on RoR will apply the patches soon enough. "I'm still very concerned about [this flaw]," says Adam O'Donnell, chief architect for the cloud technology group at Sourcefire, who yesterday posted a blog laying out the ramifications of these bugs. The server bugs could be abused with worm attacks, he said, or even worse, with attacks that silently infiltrate a large number of websites and steal information from their databases, or plant backdoors or water-hole attacks that target site visitors.

"I think the one saving grace we do have is people who generally use Ruby on Rails as their Web programming framework are also hooked into a development philosophy where they rapidly roll out changes. They are doing multiple revisions to the Web front-end in a single day," O'Donnell says. "They already have this development practice in place of pushing out changes very quickly. So my hope is that this will be cleaned up relatively quickly compared to other technologies out there."

O'Donnell says he has seen programmers at several organizations, including Sourcefire itself, drop everything and patch the RoR-based systems. "Whenever you see an exploit as a remote preauthorization code execution vulnerability, you have to drop everything to fix it," he says. "Anything that can just connect to you and attack you without a username and password and run any code it wants to is a bad situation.

"That's the reason people raised the alarm bells so quickly," he says.

Finding all RoR apps that an organization touches can be tricky, however. "Ruby on Rails is a popular framework for a lot of Web 2.0 apps, [such as] the various Twitter add-on sites and social media aggregators," says Moore, who is CSO of Rapid7.

"In many cases, the Ruby on Rails app may not be accessible from the main URL of a website, but instead mapped in a subdirectory, like '/forums' or '/dashboard.' So when scanning for RoR applications, it requires doing more than just hitting up every Web server on the front page. In many cases, you have to crawl the site, or go login to the server and look," Moore says.

Ruby on Rails, meanwhile, has basically become the "lingua franca" for startups, notes Sourcefire's O'Donnell. "The reason you don't see as many vulns in Ruby on Rails as you do in older programming frameworks is that there were a lot of lessons learned [from those platforms] applied to what we have today" with RoR, he says. "Ruby on Rails is definitely a platform that enforces good coding habits. It's been shown to lead to better security practices."

Security experts recommend patching RoR apps now if you have not already done so. Said O'Donnell in a blog post yesterday: "If you are running Rails code, stop what you are doing and upgrade your Rails environment right now. If you are managing people who are writing Rails code, get them to upgrade their environment immediately. If you are a web hoster that has a significant number of people running Rails code, contact your customers and get them to upgrade. Order lunch in. Don’t go home. Stop reading this and fix the problem. You get the idea."

Moore, who also posted a blog yesterday with technical details on the vulnerabilities, says he expects to see more RoR attacks as more applications run on the platform.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
BrianBuchalter
50%
50%
BrianBuchalter,
User Rank: Apprentice
1/11/2013 | 12:55:03 PM
re: Attack Code, Metasploit Module Released For Serious Ruby On Rails Bugs
For a detailed guide to using Metasploit to scan for this vulnerability and how to protect against it, see my post at-áhttp://blog.endpoint.com/2013/...
BrianBuchalter
50%
50%
BrianBuchalter,
User Rank: Apprentice
1/11/2013 | 12:25:14 PM
re: Attack Code, Metasploit Module Released For Serious Ruby On Rails Bugs
For detailed information about mitigation strategies and how to use Metasploit to verify you've closed the vulnerability see-áhttp://blog.endpoint.com/2013/...
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4807
Published: 2014-11-22
Sterling Order Management in IBM Sterling Selling and Fulfillment Suite 9.3.0 before FP8 allows remote authenticated users to cause a denial of service (CPU consumption) via a '\0' character.

CVE-2014-6183
Published: 2014-11-22
IBM Security Network Protection 5.1 before 5.1.0.0 FP13, 5.1.1 before 5.1.1.0 FP8, 5.1.2 before 5.1.2.0 FP9, 5.1.2.1 before FP5, 5.2 before 5.2.0.0 FP5, and 5.3 before 5.3.0.0 FP1 on XGS devices allows remote authenticated users to execute arbitrary commands via unspecified vectors.

CVE-2014-8626
Published: 2014-11-22
Stack-based buffer overflow in the date_from_ISO8601 function in ext/xmlrpc/libxmlrpc/xmlrpc.c in PHP before 5.2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by including a timezone field in a date, leading to improper XML-RPC encoding...

CVE-2014-8710
Published: 2014-11-22
The decompress_sigcomp_message function in epan/sigcomp-udvm.c in the SigComp UDVM dissector in Wireshark 1.10.x before 1.10.11 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted packet.

CVE-2014-8711
Published: 2014-11-22
Multiple integer overflows in epan/dissectors/packet-amqp.c in the AMQP dissector in Wireshark 1.10.x before 1.10.11 and 1.12.x before 1.12.2 allow remote attackers to cause a denial of service (application crash) via a crafted amqp_0_10 PDU in a packet.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?