Vulnerabilities / Threats
1/10/2013
03:49 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Attack Code, Metasploit Module Released For Serious Ruby On Rails Bugs

Drop everything and patch Ruby on Rails apps now, security experts say

This just got (more) real: Researchers today unleashed exploit code for a pair of newly found vulnerabilities in the popular Web application programming platform Ruby on Rails (RoR), as well as a new Metasploit module for the most serious of the two flaws, raising concerns of potentially damaging attacks to come on Web servers and databases.

Patches for the two Ruby on Rails vulnerabilities, CVE-2013-0155 and CVE-2013-0156, were issued yesterday after researchers disclosed the bugs earlier this week. Ruby on Rails is an open-source Web programming framework that runs in more than 200,000 websites and on tens of thousands of apps, including Twitter, Metasploit, Groupon, Scribd, Hulu, Living Social, Yellow Pages, and GitHub.

To date, RoR hasn't experienced much in the way of security vulnerability issues, but this new bug finds likely will open the floodgates for more research into holes -- and attacks, security experts say.

Most worrisome is the CVE-2013-0156 bug, which would allow an attacker to execute code remotely on any RoR application that has the XML parser enabled, which is a default setting. The attacker could then steal data from the back-end database, as well as poison the application or website with backdoors and water-hole attacks.

"It's pretty bad," says HD Moore, chief architect of the Metasploit Project, which had to patch its own software for the flaws yesterday. Moore says it's not just the 200,000 sites running on RoR, but also a "huge number of products" running on it that need to be patched.

Moore and his team found themselves in the strange position of having to patch for a flaw that they would then weaponize with an RoR exploit in Metasploit. "Everyone missed it -- our internal and external coders," Moore says of the RoR bugs in Metasploit.

While there were no known attacks as of this posting, security experts still worry that organizations with fewer resources or knowledge of what they have running on RoR will apply the patches soon enough. "I'm still very concerned about [this flaw]," says Adam O'Donnell, chief architect for the cloud technology group at Sourcefire, who yesterday posted a blog laying out the ramifications of these bugs. The server bugs could be abused with worm attacks, he said, or even worse, with attacks that silently infiltrate a large number of websites and steal information from their databases, or plant backdoors or water-hole attacks that target site visitors.

"I think the one saving grace we do have is people who generally use Ruby on Rails as their Web programming framework are also hooked into a development philosophy where they rapidly roll out changes. They are doing multiple revisions to the Web front-end in a single day," O'Donnell says. "They already have this development practice in place of pushing out changes very quickly. So my hope is that this will be cleaned up relatively quickly compared to other technologies out there."

O'Donnell says he has seen programmers at several organizations, including Sourcefire itself, drop everything and patch the RoR-based systems. "Whenever you see an exploit as a remote preauthorization code execution vulnerability, you have to drop everything to fix it," he says. "Anything that can just connect to you and attack you without a username and password and run any code it wants to is a bad situation.

"That's the reason people raised the alarm bells so quickly," he says.

Finding all RoR apps that an organization touches can be tricky, however. "Ruby on Rails is a popular framework for a lot of Web 2.0 apps, [such as] the various Twitter add-on sites and social media aggregators," says Moore, who is CSO of Rapid7.

"In many cases, the Ruby on Rails app may not be accessible from the main URL of a website, but instead mapped in a subdirectory, like '/forums' or '/dashboard.' So when scanning for RoR applications, it requires doing more than just hitting up every Web server on the front page. In many cases, you have to crawl the site, or go login to the server and look," Moore says.

Ruby on Rails, meanwhile, has basically become the "lingua franca" for startups, notes Sourcefire's O'Donnell. "The reason you don't see as many vulns in Ruby on Rails as you do in older programming frameworks is that there were a lot of lessons learned [from those platforms] applied to what we have today" with RoR, he says. "Ruby on Rails is definitely a platform that enforces good coding habits. It's been shown to lead to better security practices."

Security experts recommend patching RoR apps now if you have not already done so. Said O'Donnell in a blog post yesterday: "If you are running Rails code, stop what you are doing and upgrade your Rails environment right now. If you are managing people who are writing Rails code, get them to upgrade their environment immediately. If you are a web hoster that has a significant number of people running Rails code, contact your customers and get them to upgrade. Order lunch in. Don’t go home. Stop reading this and fix the problem. You get the idea."

Moore, who also posted a blog yesterday with technical details on the vulnerabilities, says he expects to see more RoR attacks as more applications run on the platform.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
BrianBuchalter
50%
50%
BrianBuchalter,
User Rank: Apprentice
1/11/2013 | 12:55:03 PM
re: Attack Code, Metasploit Module Released For Serious Ruby On Rails Bugs
For a detailed guide to using Metasploit to scan for this vulnerability and how to protect against it, see my post at-áhttp://blog.endpoint.com/2013/...
BrianBuchalter
50%
50%
BrianBuchalter,
User Rank: Apprentice
1/11/2013 | 12:25:14 PM
re: Attack Code, Metasploit Module Released For Serious Ruby On Rails Bugs
For detailed information about mitigation strategies and how to use Metasploit to verify you've closed the vulnerability see-áhttp://blog.endpoint.com/2013/...
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8802
Published: 2015-01-23
The Pie Register plugin before 2.0.14 for WordPress does not properly restrict access to certain functions in pie-register.php, which allows remote attackers to (1) add a user by uploading a crafted CSV file or (2) activate a user account via a verifyit action.

CVE-2014-9623
Published: 2015-01-23
OpenStack Glance 2014.2.x through 2014.2.1, 2014.1.3, and earlier allows remote authenticated users to bypass the storage quote and cause a denial of service (disk consumption) by deleting an image in the saving state.

CVE-2014-9638
Published: 2015-01-23
oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a WAV file with the number of channels set to zero.

CVE-2014-9639
Published: 2015-01-23
Integer overflow in oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (crash) via a crafted number of channels in a WAV file, which triggers an out-of-bounds memory access.

CVE-2014-9640
Published: 2015-01-23
oggenc/oggenc.c in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted raw file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.