Ruby on Rails releases "extremely critical" fixes

Share this article:
The maintainers of the Ruby on Rails have pushed out the second update in a week to fix critical holes in the web application framework which allows attackers to compromise applications.

The "two extremely critical security fixes" close off parameter parsing flaws present in all versions of Ruby on Rails which allows attackers to bypass authentication and execute arbitrary code in Rails apps.

"There are multiple weaknesses in the parameter parsing code for Ruby on Rails, which allows attackers to bypass authentication systems, inject arbitrary SQL, inject and execute arbitrary code, or perform a DoS attack on a Rails application," an advisory stated. "Due to the critical nature of this vulnerability, and the fact that portions of it have been disclosed publicly, all users running an affected release should either upgrade or use one of the workarounds immediately."

Attackers could take advantage of code that supported certain unsuitable conversions, the maintainers said.

"The parameter parsing code of Ruby on Rails allows applications to automatically cast values from strings to certain data types. Unfortunately the type casting code supported certain conversions which were not suitable for performing on user-provided data including creating Symbols and parsing YAML. These unsuitable conversions can be used by an attacker to compromise a Rails application."

Users could disable this conversion or XML as a workaround, but should upgrade if possible.

Popular e-commerce application Spree, which uses Rails, applied the fix hours ago.

But one user claims the update to Rails 3.2.11 introduces a bug.

The update followed a fix pushed out last week for a SQL injection vulnerability located in Rails' Active Record database query interface.

This story originally appeared on SCMagazine.com.au.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

More in News

CryptoWall surpasses CryptoLocker in infection rates

CryptoWall surpasses CryptoLocker in infection rates

A threat analysis from Dell SecureWorks CTU says that CryptoWall has picked up where its famous sibling left off.

Professor says Google search, not hacking, yielded medical info

Professor says Google search, not hacking, yielded medical ...

A professor of ethical hacking at City College San Francisco came forward to clarify that he did not demonstrate hacking a medical center's server in a class.

Syrian Malware Team makes use of enhanced BlackWorm RAT

Syrian Malware Team makes use of enhanced BlackWorm ...

FireEye analyzed the hacking group's use of the malware, dubbed the "Dark Edition" of BlackWorm.