Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

1/10/2013
03:49 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Attack Code, Metasploit Module Released For Serious Ruby On Rails Bugs

Drop everything and patch Ruby on Rails apps now, security experts say

This just got (more) real: Researchers today unleashed exploit code for a pair of newly found vulnerabilities in the popular Web application programming platform Ruby on Rails (RoR), as well as a new Metasploit module for the most serious of the two flaws, raising concerns of potentially damaging attacks to come on Web servers and databases.

Patches for the two Ruby on Rails vulnerabilities, CVE-2013-0155 and CVE-2013-0156, were issued yesterday after researchers disclosed the bugs earlier this week. Ruby on Rails is an open-source Web programming framework that runs in more than 200,000 websites and on tens of thousands of apps, including Twitter, Metasploit, Groupon, Scribd, Hulu, Living Social, Yellow Pages, and GitHub.

To date, RoR hasn't experienced much in the way of security vulnerability issues, but this new bug finds likely will open the floodgates for more research into holes -- and attacks, security experts say.

Most worrisome is the CVE-2013-0156 bug, which would allow an attacker to execute code remotely on any RoR application that has the XML parser enabled, which is a default setting. The attacker could then steal data from the back-end database, as well as poison the application or website with backdoors and water-hole attacks.

"It's pretty bad," says HD Moore, chief architect of the Metasploit Project, which had to patch its own software for the flaws yesterday. Moore says it's not just the 200,000 sites running on RoR, but also a "huge number of products" running on it that need to be patched.

Moore and his team found themselves in the strange position of having to patch for a flaw that they would then weaponize with an RoR exploit in Metasploit. "Everyone missed it -- our internal and external coders," Moore says of the RoR bugs in Metasploit.

While there were no known attacks as of this posting, security experts still worry that organizations with fewer resources or knowledge of what they have running on RoR will apply the patches soon enough. "I'm still very concerned about [this flaw]," says Adam O'Donnell, chief architect for the cloud technology group at Sourcefire, who yesterday posted a blog laying out the ramifications of these bugs. The server bugs could be abused with worm attacks, he said, or even worse, with attacks that silently infiltrate a large number of websites and steal information from their databases, or plant backdoors or water-hole attacks that target site visitors.

"I think the one saving grace we do have is people who generally use Ruby on Rails as their Web programming framework are also hooked into a development philosophy where they rapidly roll out changes. They are doing multiple revisions to the Web front-end in a single day," O'Donnell says. "They already have this development practice in place of pushing out changes very quickly. So my hope is that this will be cleaned up relatively quickly compared to other technologies out there."

O'Donnell says he has seen programmers at several organizations, including Sourcefire itself, drop everything and patch the RoR-based systems. "Whenever you see an exploit as a remote preauthorization code execution vulnerability, you have to drop everything to fix it," he says. "Anything that can just connect to you and attack you without a username and password and run any code it wants to is a bad situation.

"That's the reason people raised the alarm bells so quickly," he says.

Finding all RoR apps that an organization touches can be tricky, however. "Ruby on Rails is a popular framework for a lot of Web 2.0 apps, [such as] the various Twitter add-on sites and social media aggregators," says Moore, who is CSO of Rapid7.

"In many cases, the Ruby on Rails app may not be accessible from the main URL of a website, but instead mapped in a subdirectory, like '/forums' or '/dashboard.' So when scanning for RoR applications, it requires doing more than just hitting up every Web server on the front page. In many cases, you have to crawl the site, or go login to the server and look," Moore says.

Ruby on Rails, meanwhile, has basically become the "lingua franca" for startups, notes Sourcefire's O'Donnell. "The reason you don't see as many vulns in Ruby on Rails as you do in older programming frameworks is that there were a lot of lessons learned [from those platforms] applied to what we have today" with RoR, he says. "Ruby on Rails is definitely a platform that enforces good coding habits. It's been shown to lead to better security practices."

Security experts recommend patching RoR apps now if you have not already done so. Said O'Donnell in a blog post yesterday: "If you are running Rails code, stop what you are doing and upgrade your Rails environment right now. If you are managing people who are writing Rails code, get them to upgrade their environment immediately. If you are a web hoster that has a significant number of people running Rails code, contact your customers and get them to upgrade. Order lunch in. Don’t go home. Stop reading this and fix the problem. You get the idea."

Moore, who also posted a blog yesterday with technical details on the vulnerabilities, says he expects to see more RoR attacks as more applications run on the platform.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
BrianBuchalter
50%
50%
BrianBuchalter,
User Rank: Apprentice
1/11/2013 | 12:55:03 PM
re: Attack Code, Metasploit Module Released For Serious Ruby On Rails Bugs
For a detailed guide to using Metasploit to scan for this vulnerability and how to protect against it, see my post at-http://blog.endpoint.com/2013/...
BrianBuchalter
50%
50%
BrianBuchalter,
User Rank: Apprentice
1/11/2013 | 12:25:14 PM
re: Attack Code, Metasploit Module Released For Serious Ruby On Rails Bugs
For detailed information about mitigation strategies and how to use Metasploit to verify you've closed the vulnerability see-http://blog.endpoint.com/2013/...
News
Former CISA Director Chris Krebs Discusses Risk Management & Threat Intel
Kelly Sheridan, Staff Editor, Dark Reading,  2/23/2021
Edge-DRsplash-10-edge-articles
Security + Fraud Protection: Your One-Two Punch Against Cyberattacks
Joshua Goldfarb, Director of Product Management at F5,  2/23/2021
News
Cybercrime Groups More Prolific, Focus on Healthcare in 2020
Robert Lemos, Contributing Writer,  2/22/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Building the SOC of the Future
Building the SOC of the Future
Digital transformation, cloud-focused attacks, and a worldwide pandemic. The past year has changed the way business works and the way security teams operate. There is no going back.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-3633
PUBLISHED: 2021-02-25
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE-2021-20203
PUBLISHED: 2021-02-25
An integer overflow issue was found in the vmxnet3 NIC emulator of the QEMU for versions up to v5.2.0. It may occur if a guest was to supply invalid values for rx/tx queue size or other NIC parameters. A privileged guest user may use this flaw to crash the QEMU process on the host resulting in DoS s...
CVE-2021-3406
PUBLISHED: 2021-02-25
A flaw was found in keylime 5.8.1 and older. The issue in the Keylime agent and registrar code invalidates the cryptographic chain of trust from the Endorsement Key certificate to agent attestations.
CVE-2021-20327
PUBLISHED: 2021-02-25
A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Node....
CVE-2021-20328
PUBLISHED: 2021-02-25
Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in inte...