Rails 3.2.18, 4.0.5 and 4.1.1 have been released(weblog.rubyonrails.org)
weblog.rubyonrails.org
Rails 3.2.18, 4.0.5 and 4.1.1 have been released
http://weblog.rubyonrails.org/2014/5/6/Rails_3_2_18_4_0_5_and_4_1_1_have_been_released/
5 comments
I feel the title should tell that the releases are because of a directory traversal vulnerability: https://groups.google.com/forum/#!msg/rubyonrails-security/N...
This release only has one fix, but it's common to have multiple fixes. It would impractical to identify all fixes in a release title, and HN guidelines on titles are to "use the original title, unless it is misleading or linkbait"
Tangential security nitpick - doesn't it defeat the purpose to display SHA or MD5 sums for downloads over a non-ssl page?
A bad actor could easily modify these in a proxy etc when serving the page.
Edit: Unless the purpose isn't to prevent tampering, but for error-correction.
A bad actor could easily modify these in a proxy etc when serving the page.
Edit: Unless the purpose isn't to prevent tampering, but for error-correction.
An attacker would have to modify the actual gem files in a way that would yield the same checksums, since the hashing is one way only.
The attack scenario is that the man-in-the-middle alters the checksums in the page to match the checksums of his backdoored version.
There's also an 'Unsafe Query Risk', which is not a CVE and does not have a patch.[0]
I believe this script[1] should expose some of those dangerous columns. There's still the join alias risk, but I'm not sure, other than parsing a schema.rb, how to get at those effectively.
[0] https://groups.google.com/forum/#!topic/rubyonrails-security...
[1] https://gist.github.com/KevinMcHugh/fab941ec3677f9a19ee0
I believe this script[1] should expose some of those dangerous columns. There's still the join alias risk, but I'm not sure, other than parsing a schema.rb, how to get at those effectively.
[0] https://groups.google.com/forum/#!topic/rubyonrails-security...
[1] https://gist.github.com/KevinMcHugh/fab941ec3677f9a19ee0
something like this will find any associations that share a name with a column in each model: https://gist.github.com/jenseng/2039fd57f5db40779871
Thanks a lot for this script, I was going to check manually.
For all those who can't upgrade to the latest versions of Rails: Zweitag (my employer) maintains a Rails fork with security fixes applied to all Rails releases since 3.1.0.
https://github.com/zweitag/rails/branches
https://github.com/zweitag/rails/branches
And for 3.0 and older: https://railslts.com/
The original CVE has been amended[1] since having *action in the route is not the only attack vector.
[1]https://groups.google.com/forum/#!topic/rubyonrails-security...
[1]https://groups.google.com/forum/#!topic/rubyonrails-security...