<div dir="ltr"><div>+1, this vulnerability allows you to run more or less whatever code you like in any application, <b>even if you don't have controllers.</b></div><div><b><br></b></div><div>Riding rails announcement: <a href="http://www.insinuator.net/2013/01/rails-yaml/" target="_blank">http://www.insinuator.net/2013/01/rails-yaml/</a></div>
<div><br></div>The versions you want are 3.2.11, 3.1.10, 3.0.19 or 2.3.15. <div><br></div><div>If for whatever reason you can't upgrade to straight away, the report linked below highlights some workarounds you can stick in an initialiser that mitigates this particular vulnerability (though you <i>really</i> should upgrade, a large number of subtle security bugs have been unearthed over the past few point releases):<div>
<br></div><div><a href="https://groups.google.com/forum/#!topic/rubyonrails-security/61bkgvnSGTQ/discussion" target="_blank">https://groups.google.com/forum/#!topic/rubyonrails-security/61bkgvnSGTQ/discussion</a></div><div>
<br></div><div>
A run down of the details (without going into specific exploits) here:</div><div><br></div><div><a href="http://www.insinuator.net/2013/01/rails-yaml/" target="_blank">http://www.insinuator.net/2013/01/rails-yaml/</a></div>
<div><br></div>
<div>The gist of it is that Rails will automatically deserialize YAML in your XML request body by default. Since it deserializes YAML, it will instantiate and set instance variables with whatever class you pass in as input. Hilarity ensues.</div>
<div><br></div><div style>No one has reported these exploits 'in the wild' yet, its all been via security researchers reporting in independently. Exploits for this vulnerability are quite trivial to develop now that the vulnerability is public knowledge, so in case I haven't made myself entirely clear: <b>upgrade now</b>. </div>
<div><br></div><div>-Ali</div><div><br></div><div><br><div><br></div><div><br></div></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Wed, Jan 9, 2013 at 2:10 AM, Michael Mokrysz <span dir="ltr"><<a href="mailto:sites@46bit.com" target="_blank">sites@46bit.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Mark, that's from the previous vulnerability, which for several reasons was minor.<div><br></div><div><b>This new vulnerability is about as serious as it gets. SQL Injection, Code Execution, etc are all possible on any Rails app, and well within the skills of <i>any</i> script kiddie.</b></div>
<div><br></div><div>You want to upgrade or mitigate this as soon as you possibly can.</div><div class="HOEnZb"><div class="h5"><div><br><div class="gmail_quote">On Wed, Jan 9, 2013 at 1:45 AM, Mark Burns <span dir="ltr"><<a href="mailto:markthedeveloper@gmail.com" target="_blank">markthedeveloper@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">This gives a useful breakdown of the details<div><br></div><div> <a href="http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-hold-your-horses-here-are-the-facts/" target="_blank">http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-hold-your-horses-here-are-the-facts/</a>
</div></div><div class="gmail_extra"><br><br><div class="gmail_quote"><div><div>On 9 January 2013 06:20, Matthew Rudy Jacobs <span dir="ltr"><<a href="mailto:matthewrudyjacobs@gmail.com" target="_blank">matthewrudyjacobs@gmail.com</a>></span> wrote:<br>
</div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div><div dir="ltr">I guess you all know.<div><br></div><div>But for anyone who hasn't yet heard.</div>
<div>All versions of rails need to be upgraded or patched.</div>
<div><br></div><div><a href="https://groups.google.com/forum/#!topic/rubyonrails-security/61bkgvnSGTQ/discussion" style="font-family:arial,sans-serif;font-size:13px" target="_blank">https://groups.google.com/forum/#!topic/rubyonrails-security/61bkgvnSGTQ/discussion</a><br>
</div></div>
<br></div></div>_______________________________________________<br>
Chat mailing list<br>
<a href="mailto:Chat@lists.lrug.org" target="_blank">Chat@lists.lrug.org</a><br>
<a href="http://lists.lrug.org/listinfo.cgi/chat-lrug.org" target="_blank">http://lists.lrug.org/listinfo.cgi/chat-lrug.org</a><br>
<br></blockquote></div><br></div>
<br>_______________________________________________<br>
Chat mailing list<br>
<a href="mailto:Chat@lists.lrug.org" target="_blank">Chat@lists.lrug.org</a><br>
<a href="http://lists.lrug.org/listinfo.cgi/chat-lrug.org" target="_blank">http://lists.lrug.org/listinfo.cgi/chat-lrug.org</a><br>
<br></blockquote></div><br></div>
</div></div><br>_______________________________________________<br>
Chat mailing list<br>
<a href="mailto:Chat@lists.lrug.org">Chat@lists.lrug.org</a><br>
<a href="http://lists.lrug.org/listinfo.cgi/chat-lrug.org" target="_blank">http://lists.lrug.org/listinfo.cgi/chat-lrug.org</a><br>
<br></blockquote></div><br></div></div>