Ruby on Rails vulnerable to mass assignment and SQL injection

http://www.zweitag.de/en/blog/ruby-on-rails-vulnerable-to-mass-assignment-and-sql-injection

by WestCoastJustin • 13 years ago

123 87 13 years ago

zweitag.de

peterlih• 13 years ago

Great job, Thomas!

lexy0202• 13 years ago

Very good explanation - thanks.

trevorcreech• 13 years ago

I love building stuff with Rails, but these last few weeks are making me glad I'm not maintaining it in production.

thelarry2• 13 years ago

I get a little chuckle when I tell people I am building some app and they ask "Why aren't you using RoR and MongoDB?" Maybe I am not comfortable with them in production?

meaty9• 13 years ago

I am of the same opinion. Having trialled both extensively, we stuck with asp.net MVC and SQL server. Expensive but well engineered.

nathan_long• 13 years ago

Before you chuckle, you should be sure that you're doing security better than Rails. Read this and see how your framework or custom code stacks up.

http://guides.rubyonrails.org/security.html

Also, ask yourself: "when I have a security vulnerability, how easy is it to fix?" Fixing a Rails vulnerability and deploying the fix to production takes about 2 minutes.

hakaaaaak5• 13 years ago

Now imagine if you'd written 10x as much code in Java and hit a Java vulnerability. The U.S. government told its citizens to uninstall Java recently. There have been a few other high profile Java vulnerabilities in the past few years. Does that mean Java is the wrong choice? Most jobs available in development are in Java (check indeed.com).

For years Microsoft was the butt of most security jokes. .Net dev jobs are #2 under Java in indeed.com.

Find me a well-used platform that hasn't had a massive security hole or a community that hasn't tended to write insecure code at some point.

X-Istence3• 13 years ago

A lot of jobs in Java are not for Java Applets running on peoples machines, a lot of the Java work is for client side apps, and for server side apps (think app development like RoR).

Java applets are not necessary.

The reason why the US government said to uninstall Java is because it is the quickest and easiest way for the layman to remove the ability for Java applets to run. If Sun^H^H^HOracle provided a way to just install Java so it can be used for client side apps without turning on Java applets in the browser, then it is not any less unsafe than C++/C#/Obj-C apps running on the same system.

dredmorbius• 13 years ago

"Java" is a bunch of different things that run in a bunch of different places. It's a language, a bytecode interpreter, and a virtual machine. The virtual machine may run on a server, or client side. Most of the more significant Java security issues of late have been on the client-side JVM plugin support for browsers, which affects the ability to run Java applets client-side.

For most contemporary Web development, "Java development" translates as "server-side Java programmer". Which isn't without its warts (trust me on this), but it's not the place that has seen a lot of heat, despite Oracle's best efforts to fuck everything up.

The recent situation with RoR has been vastly worse, and has been server-side.

As for that well-used platform and community with few security holes, I'd suggest you look up the OpenBSD folk, if you count an OS as a platform. They take a preemptively secure approach on all system code, to the point of rewriting major libraries. Yes, it's a bit less free-form than all the cool kids like to play these days, but damned if it's not a solid platform. And that "secure by default" mentality means they avoid much of the pain other OS developers (including Linux, which I much prefer to admin myself) encounter.

RoR and Ruby have, to my mind and experience, a cultural problem with regards to security. And they're becoming widely enough used that it's starting to show.

matthuggins• 13 years ago

Good explanation, but it sounds like there is a second component to the issue that this doesn't address: the fact that user input can be converted to symbols, which will ultimately eat memory as new symbols are created.

sergiotapia• 13 years ago

Again? We need a single website alerting RoR devs about vulnerabilities.

I shouldn't have to found out about these things on HackerNews.

Someone build this website for us RoR devs, pretty please? (ps. use PHP - heh)

TomasSedovic• 13 years ago

This is the Ruby on Rails Security mailing list:

https://groups.google.com/forum/#!forum/rubyonrails-security

you can view it in the browser but unlike with a vanilla website, you can also receive notifications via an email.

kingnothing2• 13 years ago

Twitter works great for this.

spencerfry• 13 years ago

Heroku does a good job of notifying its users.

static_typed4• 13 years ago

You could always wait till the server gets compromised, then the customers could alert you?

nichols• 13 years ago

Actually, that's how security vulnerabilities are normally handled in the Ruby on Rails world.

What, you think I'm joking? Think again: http://arstechnica.com/business/2012/03/hacker-commandeers-g...

minikomi• 13 years ago

Sounds like a RoR bat-signal!

jiggy20116• 13 years ago

How do you guys who are freelancers or perhaps you work for a company and are the only guy working on a particular app handle security stuff like this?

A lot of what I hear is "drop what you are doing and patch this right now!". But of course there are many reasons why this might not be possible. For example you might be on a 15 hour flight with no internet, you might be dealing with some family crisis, you might be in the middle of a coke and sex binge with identical twins who look like Scarlett Johansen or whatever.

Do you live glued to your smartphone in constant fear of 0 days? Do you make sure there is some third party available to deal with this stuff? do you design with the possibility of having your app/site owned as a likely event?

And how do you make your client/employer aware of the implications of stuff like this?

kingnothing2• 13 years ago

If you can drop everything you're doing and patch your system the moment a patch is available, that's great! Do that. For most of us, it'll probably be the next morning or next workday when you would take care of a security patch.

jiggy20116• 13 years ago

Is this something you put into contracts with clients (assuming you are doing client work)?

I'm curious about how people do security SLAs or whatever.

static_typed4• 13 years ago

We actually moved off Ruby/Rails because of all this, but previously it was a test in QA, then patch Prod, both on same day of the word hitting the street that there was yet another hole to close

charliesome• 13 years ago

What are you going to do when whatever you're currently using has a security problem?

Moving off Rails is not a panacea

BSousa2• 13 years ago

As I asked in another thread discussing Rails security, what are the alternatives? What did you move to?

I honestly want to know. I can understand that Rails has this problems, and due to the way it originated (37 Signals apps) I can understand if security wasn't top priority. But now it does scare me a lot. I'm designing a product to be deployed at some large companies and every day I feel less and less secure about using Rails for that. It will be hard to explain to an executive in a top 500 company that I have to patch the damn system every week for a new problem.

petercooper• 13 years ago

I was living in hospital with my wife having a baby when the last one hit and, yep, I did it all tethered over a phone. First time I've done work in a room while someone was getting set up for a blood transfusion ;-)

chc3• 13 years ago

Before anybody gets the wrong idea here: Yes, there are a lot of highly publicized Rails vulnerabilities lately. If you avoid Rails, it will protect you from these vulnerabilities. But give somebody familiar with pentesting a little while with your app and I rather strongly suspect they will find new and different vulnerabilities that would horrify you as much as anything you find in Rails.

Rails gets a lot of scrutiny. Just because your ad hoc Flask app doesn't does not mean it would hold up a lot better. If you believe it will, think very hard about the reasons.

(This is not to say you shouldn't use something else either — just that the gut instinct of "Well, my app on this little microframework won't be getting security advisories every couple of weeks" is not necessarily something you want to follow. Like I said, think very hard about whether you really believe you can do justice to your app better than the Rails security team. And read up on some anecdotes from people who do application security while you're thinking about it, because I find people tend to underestimate just how broken most software is.)

saurik• 13 years ago

I agree with you; however, there is something to be said for "not subject to drive-by mass tagetings on short notice" that is ignored by this argument. There may be 7 obvious bug in your program, but of you have a couple hundred users, will any of them bother? However, even if you have no users at all, you are going to get hacked by these 0-days due to people just scanning the Internet looking for vulnerable systems. In my case, every single time I've been hacked has been due to a 0-day dropping that I didn't pay enough attention to (like exim4), as opposed to the assuredly infinate number of bugs I have in my own software.

chc3• 13 years ago

That's true, and there's something to be said for that, though I'm ambivalent about exactly what that something is. That's part of why I tried to make it clear that my point was "Don't knee-jerk on this" rather than "You must stick with Rails or you are a fool." I'm not going to preach security practices at people — there are people much better qualified to do that — I just want people to make sure they understand what tradeoffs they're making with whatever decision they make. A lot of people have drastic misconceptions about these sorts of things. If you're intending to have a little site that largely depends on security through obscurity not to get owned, you should at least know that.

jiggy20116• 13 years ago

Out of those couple of hundred users you only need one of them to be a bored teenager who has read a bit about web security to bust your application.

It's not like this stuff is that hard in a lot of cases, it's often just "if I put a semicolon in the URL, how does it respond?" or "does this form have a CSRF token?".

X-Istence3• 13 years ago

I know you mentioned Flask, but I haven't seen the same sort of stuff for Django, Pylons or Pyramid. Yes, some if not all of those frameworks use the flawed Pickle method for storing cookies, but so long as the secret is, well a secret, there is no way to get remote code execution on a very simple app built on those frameworks.

static_typed4• 13 years ago

Sadly, in the Ruby community shiny and magic are seen as more important than secure, robust or well engineered. That is the bottom line, and if choosing a new framework or language for your new projects, developers should really consider this. Yes, it is wonderful creating meta DSLs, scaffold create new blog, and the rest. But when the server gets compromised, it looks a lot less shiny.

chc3• 13 years ago

This seems like a slightly gussied-up version of "Ruby developers smell bad." It's just a bunch of ad hominem against the Ruby community with no substance to justify it. If you had accused the Ruby community of valuing cool new tricks over solid engineering seven years ago, it might have been a little bit realistic, because the Ruby community was small and starry-eyed back then and there wasn't a whole lot of battle-hardened code.

But nowadays? Rails is actually quite mature and a lot of work has gone into its engineering. It has a security team and they take these things very seriously. You might not feel they're doing well enough, but accusing them (based on no evidence whatsoever) of being obsessed with "shiny" things is not the way to express that concern.

This is not to say that you can't use whatever you want, obviously. Just that you seem to be throwing around dated stereotypes in service of a language pissing match rather than critically analyzing the merits of the framework.

tomkin2• 13 years ago

I wonder what DHH has to say about all of this? I seem to remember a few of his posts being pretty harsh on security and security of other platforms. I can't imagine DHH completely washes his hands of these vulnerabilities?

rednukleus• 13 years ago

https://twitter.com/dhh/status/289669574427820032

This was his reaction last time there were posts on HN about security vulnerabilities in Rails.

tomkin2• 13 years ago

Funny he calls HN a cesspool, "It appears that HN is following the law of large communities: they go to shit." [1] – using Twitter, a community of millions. Plus, he has posted here as recently as 10 days ago. :D

[1] https://twitter.com/dhh/status/289728046230028288

Ruby on Rails vulnerable to mass assignment and SQL injection

Related Stories