Exploitation of an old Rails vulnerability

Re:Exploitation of an old Rails vulnerability by fhars on Monday May 27, 2013 @06:21PM (#5776909)

Some people in that thread are running rails 3.2.9 end even 3.2.3, and the cited malicious requests contain url paramters the dedoce to ?id=\n---\n!ruby/object:Gem::Requirement\nrequirements:\n -

I.e., they have been grossly negligient in their server maintenance for most of this year. http://www.kalzumeus.com/2013/01/31/what-the-rails-security-...

[Edit: although at least one mentions 3.2.11, which should have that particular vulnerability fixed, so it will probably at least sometimes be someting else.]

[ Parent | on HN ]

Re:Exploitation of an old Rails vulnerability by tomfakes on Monday May 27, 2013 @06:35PM (#5776975)

On exactly this subject, I'm in the process of building a SaaS app that will alert you of security vulnerabilities in Gems in your Rails and other Ruby apps.

http://www.rubyaudit.com

[ Parent | on HN ]

Re:Exploitation of an old Rails vulnerability by trustfundbaby on Tuesday May 28, 2013 @12:58AM (#5778166)

You should know that New Relic is already doing this with Rails versions right now

[ Parent | on HN ]

Re:Exploitation of an old Rails vulnerability by Hates_ on Monday May 27, 2013 @06:36PM (#5776979)

Doesn't seem to be anywhere to sign up.

[ Parent | on HN ]

Re:Exploitation of an old Rails vulnerability by tomfakes on Monday May 27, 2013 @06:48PM (#5777019)

Doh! I just got the landing page setup, and the signup configured, but never pushed it out.

Try it now.

Thanks

[ Parent | on HN ]

Re:Exploitation of an old Rails vulnerability by piggity on Monday May 27, 2013 @10:23PM (#5777665)

Interesting idea, it looks like you scan the Gemfile.lock (or equivalent) at "deploy" time.

My preference would be to upload that Gemfile.lock to a location, and then it could be scanned as and when new vulnerabilities were detected.

[ Parent | on HN ]

Re:Exploitation of an old Rails vulnerability by tomfakes on Monday May 27, 2013 @10:48PM (#5777744)

The problem with an upload is that you rely on someone to re-upload when they change their Gems. Changing the locked Gems means a re-check is needed, as they might have switched to bad versions.

Making this automatic is the key part - if you don't get burned very often, you'll eventually forget to do the right thing manually and open yourselves to badness.

[ Parent | on HN ]

Re:Exploitation of an old Rails vulnerability by packetlss on Monday May 27, 2013 @06:29PM (#5776949)

Yes. Looks like a case of explotation of CVE-2013-0156.

[ Parent | on HN ]