Use Rails? Check yourself for the YAML exploit

Re:Use Rails? Check yourself for the YAML exploit by px43 on Friday February 01, 2013 @04:58PM (#5153755)

Your scanner says 3 issues on my domain, but rails_xml_yaml_scanner instantly says none. Is your scanner scanning for more than the yaml thing? I don't really have access to just modify a production system on the fly to go through your verification process, and I don't want to go through all the trouble if it's just some nessus nag. It's confusing because it says three issues, but low impact. I thought I was only scanning for a yaml flaw, and yaml flaws typically lead to remote code exec.

edit : I somehow stumbled into the full scanner on the main site rather than using the yaml scanner, my bad.

[ Parent | on HN ]

Re:Use Rails? Check yourself for the YAML exploit by ainsleyb on Friday February 01, 2013 @05:02PM (#5153787)

Sorry about the confusion.

If you run a scan from our homepage, you're actually looking for a lot more than just the YAML vulnerability (XSS, Mixed Resource, etc.) as our product isn't limited to just the YAML vulnerability.

If you run the scan from https://www.tinfoilsecurity.com/railscheck, then you'll get a quick check for just the YAML vulnerability.

Does that clarify it a bit?

[ Parent | on HN ]

Re:Use Rails? Check yourself for the YAML exploit by px43 on Friday February 01, 2013 @05:17PM (#5153878)

Ah, not sure how I got turned around, but yes I was using the scanner from the main page. Thanks for the clarification, and nice work. This is going to help out a lot of people.

[ Parent | on HN ]