Re:Mongo BSON Injection: Ruby Regexps Strike Again
by gabeio on Wednesday June 03, 2015 @11:29PM
(#9657286)
> This is not correct.
> The vulnerability is in `bson-ruby`[1] which is written by MongoDB and used by Moped (and thus Mongoid), the official Ruby driver from MongoDB, and Mongo Mapper.
Then it's in the ruby gem of MongoDB's driver for ruby NOT in MongoDB. The title is still misleading for people who do not code in ruby and therefore are not vulnerable to the apparently ever present ruby BSON bug.
> Mongo BSON Injection
A better title would be Mongo gem BSON Injection
I am not trying to nit-pic I was fairly confused when seeing the title because I don't code in ruby and was 99% sure Mongo's core was C not ruby.
The vulnerability is in `bson-ruby`[1] which is written by MongoDB and used by Moped (and thus Mongoid), the official Ruby driver from MongoDB, and Mongo Mapper.
The only thing that _isn't_ vulnerable is Moped's BSON implementation (if reasonably recent), but it was dropped in Moped 2.x.
In reality if your using Mongo with Ruby, your most likely vulnerable, unless you happen to be on Moped 1.x.
[1] https://github.com/mongodb/bson-ruby/blob/84d8acd32ce9067ad6...