News for hackers. Stuff that matters.

A comment on SQL Injection Vulnerability in Ruby on Rails; affects all versions. Parent comment

Re:SQL Injection Vulnerability in Ruby on Rails; affects all... by cheald on Wednesday January 02, 2013 @06:06PM (#4999907)
I'm pretty sure that the injection only works when you can forge a session because sessions may contain marshalled symbols, and the dynamic finders only accepted symbol option keys as valid. You can't get Rails to construct symbols out of a params hash. Is this a separate vulnerability?
[ Parent | on HN ]
Re:SQL Injection Vulnerability in Ruby on Rails; affects all... by tptacek on Wednesday January 02, 2013 @08:09PM (#5000465)
You can get Rails to construct symbols out of a params hash in some cases.
[ Parent | on HN ]
Re:SQL Injection Vulnerability in Ruby on Rails; affects all... by cheald on Wednesday January 02, 2013 @09:41PM (#5000793)
Seconding icambron - how? Because I've been up and down that code and can't see any way to do it. Frankly, I don't think it's possible, because otherwise you would have a trivial DOS vector into any Rails application.
[ Parent | on HN ]
Re:SQL Injection Vulnerability in Ruby on Rails; affects all... by tptacek on Wednesday January 02, 2013 @10:18PM (#5000874)
It is possible, but not straightforwardly. There isn't a code path I know of that converts param keys to symbols.

(I wouldn't have said it was possible unless I had a curl line that did it, for what it's worth.)

[ Parent | on HN ]
Re:SQL Injection Vulnerability in Ruby on Rails; affects all... by cheald on Wednesday January 02, 2013 @10:21PM (#5000888)
You're the expert here, but that's really disturbing. Is it fixable?
[ Parent | on HN ]
Re:SQL Injection Vulnerability in Ruby on Rails; affects all... by ufo on Wednesday January 02, 2013 @10:13PM (#5000859)
How is this a DOS vector? Would passing a symbol instead of a string in the parameters cause the app to crash?
[ Parent | on HN ]
Re:SQL Injection Vulnerability in Ruby on Rails; affects all... by tptacek on Wednesday January 02, 2013 @10:19PM (#5000880)
No; the theory behind that attack is, Rails doesn't GC symbols, so you could just repeatedly stuff requests that created new symbols until memory was exhausted. I don't care about that attack (there are others like it), but it's viable.
[ Parent | on HN ]
Re:SQL Injection Vulnerability in Ruby on Rails; affects all... by cheald on Wednesday January 02, 2013 @10:20PM (#5000881)
Symbols are interned and never garbage collected, so if you can cause an app to create arbitrary symbols, you can cause it to use up all the RAM on the machine and throw it into swap, effectively killing its ability to respond to requests in any kind of timely fashion.
[ Parent | on HN ]
Re:SQL Injection Vulnerability in Ruby on Rails; affects all... by icambron on Wednesday January 02, 2013 @08:38PM (#5000593)
Honest question: how?
[ Parent | on HN ]
Re:SQL Injection Vulnerability in Ruby on Rails; affects all... by kill9 on Wednesday January 02, 2013 @09:56PM (#5000825)
I doubt tptacek will publicly reveal ways to exploit this (or any) vulnerability.

EDIT Well... he might, but I've never seen him do it. He's a security professional, after all.

[ Parent | on HN ]