Critical Ruby On Rails Issue Threatens 240,000 Websites

Bug allows attackers to execute arbitrary code on any version of Ruby published in the last six years.

All versions of the open source Ruby on Rails Web application framework released in the past six years have a critical vulnerability that an attacker could exploit to execute arbitrary code, steal information from databases and crash servers. As a result, all Ruby users should immediately upgrade to a newly released, patched version of the software.
That warning was sounded Tuesday in a
Google Groups
post made by Aaron Patterson, a key Ruby programmer. Due to the critical nature of this vulnerability, and the fact that portions of it have been disclosed publicly, all users running an affected release should either upgrade or use one of the work arounds immediately, he wrote. The patched versions of Ruby on Rails (RoR) are 3.2.11, 3.1.10, 3.0.19 and 2.3.15.
As a result,
more than 240,000 websites
that use Ruby on Rails Web applications are at risk of being exploited by attackers.
High-profile websites
that employ the software include Basecamp, Github, Hulu, Pitchfork, Scribd and Twitter.
[ A successful crimeware toolkit author is going on a shopping spree. See
Blackhole Botnet Creator Buys Up Zero Day Exploits
. ]
Ben Murphy, a developer who helped to confirm the vulnerability, described the underlying
flaw as quite bad
to Ars Technica. An attack can send a request to any Ruby on Rails sever and then execute arbitrary commands. Even though its complex, its reliable, so it will work 100% of the time, he said.
In a
website post
, Murphy further noted that the vulnerability affects any rails version for the last 6 years, and said hed written -- but not released -- proof-of-concept attacks that work for Rails 3.x and Rails 2.x on Ruby 1.9.3, Ruby 1.9.2 and Ruby 1.8.7 and there is no reason to believe this wouldnt work on any Ruby/Rails combination since when the bug has been introduced. In addition, he said, the exploit does not depend on code the user has written and will work with a new rails application without any controllers.
Whats the exact nature of the vulnerability? The summary is that the XML processor in RoR can be tricked into decoding the request as a YAML document or as a Ruby Symbol, both of which can expose the application to remote code execution or SQL injection, said HD Moore, the creator of the open source penetration testing toolkit Metasploit, in a
blog post
. (
YAML
is a human-readable data serialization format.)
These kinds of bugs are close to my heart, as Metasploit itself is written in Ruby, and we use Ruby on Rails within the Metasploit Community, Express and Pro user interfaces, he said. But he noted that all versions of Metasploit have now been updated with a workaround to protect them against the vulnerability.
While security researchers havent published a working, proof-of-concept exploit, many people are now hard at work studying both the vulnerability as well as techniques for exploiting it. If this pans out, this would put thousands of production websites at risk of remote compromise, said Moore.
Vulnerability-wise, it hasnt been a good month for Ruby on Rails. Last week, the team behind the framework warned that all current versions of Rails were
vulnerable to a SQL injection flaw
. They simultaneously released updated versions of the framework that patched the flaw.

Last News
▸ Travel agency fined £150,000 for breaking Data Protection Act. ◂ Discovered: 23/12/2024 Category: security	▸ 7 arrested, 3 more charged in StubHub cyber fraud ring. ◂ Discovered: 23/12/2024 Category: security	▸ Nigerian scammers now turning into mediocre malware pushers. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Critical Ruby On Rails Issue Threatens 240,000 Websites