Unsafe Query Generation Risk in Ruby on Rails (CVE-2013-0155)

Posted by Pr0 on Tuesday January 08, 2013 @03:22PM
from the groups.google.com dept.

https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/t1WFuuQyavI

( 8 comments | 47 points | on HN )

Re:Unsafe Query Generation Risk in Ruby on Rails (CVE-2013-0... by Pr0 on Tuesday January 08, 2013 @03:26PM (#5028274)

Not as serious as http://news.ycombinator.com/item?id=5028218 but still important to note.

[ Parent | on HN ]

Re:Unsafe Query Generation Risk in Ruby on Rails (CVE-2013-0... by alexkus on Tuesday January 08, 2013 @04:06PM (#5028521)

Thanks

Is there a site I can sign up for package update notifications for a bunch of projects?

I don't want info on all CVEs or all system packages but just a list of packages I'm interested in (and more than just ubuntu/Debian packages).

I seem to remember one site on HN but my google-fu is weak tonight...

[ Parent | on HN ]

Re:Unsafe Query Generation Risk in Ruby on Rails (CVE-2013-0... by nfm on Tuesday January 08, 2013 @05:38PM (#5028982)

Are you thinking of http://www.updateditis.com/ ?

[ Parent | on HN ]

Re:Unsafe Query Generation Risk in Ruby on Rails (CVE-2013-0... by AlexHamilton on Tuesday January 08, 2013 @05:56PM (#5029054)

Unfortunately, updateditis thinks that the latest Rails version is 3.2.9

[ Parent | on HN ]

Re:Unsafe Query Generation Risk in Ruby on Rails (CVE-2013-0... by alexkus on Tuesday January 08, 2013 @05:41PM (#5028994)

That's it, thanks.

[ Parent | on HN ]

Re:Unsafe Query Generation Risk in Ruby on Rails (CVE-2013-0... by teyc on Tuesday January 08, 2013 @09:52PM (#5029857)

Please, if anyone's reading this, do not release a proof-of-concept until everyone has a chance to patch. (I sense there are a lot of already busy Rails developers today).

By the way, what do freelancers on HN feel about general responsibility for security maintenance after the work has been done?

[ Parent | on HN ]

Re:Unsafe Query Generation Risk in Ruby on Rails (CVE-2013-0... by j-kidd on Tuesday January 08, 2013 @11:59PM (#5030245)

I have never done any Ruby / Rails development, but this exploit doesn't look like it requires any proof-of-concept.

My understanding is that as long as there is a JSON endpoint accepting parameters, and the parameters are used for query generation without going through a proper validation layer [1], then the app is vulnerable.

[1] In python, this would be things like FormEncode, WTForms, Colander, etc.

[ Parent | on HN ]

Re:Unsafe Query Generation Risk in Ruby on Rails (CVE-2013-0... by TallboyOne on Wednesday January 09, 2013 @01:56AM (#5030545)

What an interesting day

[ Parent | on HN ]