Use Rails? Check yourself for the YAML exploit

Re:Use Rails? Check yourself for the YAML exploit by nimblegorilla on Friday February 01, 2013 @04:56PM (#5153749)

You are providing a valuable service, but is Metasploit really necessary for this? I think this is a simpler command:

'grep rails Gemfile.lock'

If you don't see a rails version of 3.2.1, 3.1.10, 3.0.19, or 2.3.15 then you are vulnerable. Yes?

I guess in theory an attacker could have compromised your server and changed the rails version number...

[ Parent | on HN ]

Re:Use Rails? Check yourself for the YAML exploit by ainsleyb on Friday February 01, 2013 @05:00PM (#5153772)

There are other workarounds, too. You could disable XML parameter parsing, for example (as seen here: https://groups.google.com/forum/?fromgroups=#!topic/rubyonra...).

Thus, you might be running an old version, but still actually be safe by disabling the vulnerable bits.

[ Parent | on HN ]

Re:Use Rails? Check yourself for the YAML exploit by rst on Friday February 01, 2013 @10:40PM (#5155050)

Rails 2.x apps aren't necessarily using Bundler at all, and some folks may have disabled the vulnerable parsers, or installed the security patches only into an earlier version to avoid other breaking changes or new deprecations. (Rails-core has gotten better at avoiding this kind of collateral damage from upgrades, but some folks are still gun-shy.)

Actually probing the running app really is the only way to be sure.

[ Parent | on HN ]

Re:Use Rails? Check yourself for the YAML exploit by ef4 on Friday February 01, 2013 @05:49PM (#5154045)

    3.2.1 is not safe (you probably meant 3.2.11)
    3.0.19 is not safe (3.0.20 was released to fix CVE-2013-0333)
    2.3.15 is not safe (2.3.16 was released to fix CVE-2013-0333)

[ Parent | on HN ]

Re:Use Rails? Check yourself for the YAML exploit by nimblegorilla on Friday February 01, 2013 @08:23PM (#5154677)

Good point. I just copied the version numbers from the linked website - I guess it was outdated. Although I checked again and they are correct now.

[ Parent | on HN ]

Re:Use Rails? Check yourself for the YAML exploit by px43 on Friday February 01, 2013 @05:02PM (#5153784)

We use old rails, but not the affected activerecord components. Also, there are more yaml bugs in existence than the ones publicly talked about, and this would detect those issues as well.

[ Parent | on HN ]

Re:Use Rails? Check yourself for the YAML exploit by lucian1900 on Friday February 01, 2013 @05:56PM (#5154093)

A smart attacker would install a backdoor and update rails.

[ Parent | on HN ]