Download to read offline
Uploaded byJimmy Ngu
Hacking Rails
This document discusses hacking vulnerabilities in Ruby on Rails. It notes that as Ruby on Rails usage increases, it becomes a bigger target for hackers. Statistics are presented showing an increase in Common Vulnerabilities and Exposures (CVEs) reported for Ruby on Rails from 2006 to 2014. Several specific CVEs from 2013 are examined in detail, including code responsible, demonstrations of exploits, and links to patches. The document advocates for responsible disclosure of vulnerabilities and learning from past exploits to improve security.
![[Wroclaw #7] AWS (in)security - the devil is in the detail](https://cdn.slidesharecdn.com/ss_thumbnails/awsinsecurityowasp1-171206113942-thumbnail.jpg?width=640&height=640&fit=bounds)
Hacking Rails
- 1.
- 2.
- 4. Ruby on Rails •MVC based web application framework • Convention over Configuration (CoC) • Easy to learn • Magical 😇
- 5. Ruby on Rails •Created by David Heinemeier Hansson (DHH) • Extracted from Basecamp • First release in 2004
- 6. Ruby on Rails @29-11-2015
- 7. Ruby on Rails #10 1,238,205#7 source:buildwith.com
- 8. Ruby on Rails MoreUsage = Bigger Target for Hackers
- 9. CVE • Dictionary ofCommon Vulnerabilities and Exposures (CVEs)
- 10. # of CVEs 0 4 8 12 16 20 20062007 2008 2009 2010 2011 2012 2013 2014 source: cvedetails.com
- 11. CVSS Scores • CommonVulnerability Scoring System • 0 to 10 • Based on 3 metric groups (base, temporal & environmental) • Describes severity
- 12.
- 13.
- 15.
- 16. Responsible Disclosure • Allstakeholders agrees to allow a period of time for the vulnerability to be patched before publishing the details • E.g. “Ruby on Rails: Security” Google Group
- 18.
- 19. Disclaimer I am notresponsible for any shenanigans that you might partake in as a direct or indirect result of the information that I’m about to tell you.
- 20. • Understand theexploit • Look at the codes responsible • Demo • Understand the patch Approach
- 21.
- 22. • CVSS 7.5 •Execute Code / Sql Injection / Bypass a restriction or similar • Allows YAML to be loaded via JSON payload • Basically exploiting YAML::load(yaml) CVE-2013-0333
- 23. • lib/action_dispatch/middleware/params_parser.rb • lib/active_support/json/decoding.rb •lib/active_support/json/backends/yaml.rb Code Responsible
- 24.
- 25.
- 26. CVE-2013-0156 • CVSS 7.5 •Denial Of Service / Execute Code • Allows YAML to be loaded via XML payload • Exploiting YAML::load(yaml) ... again
- 27. Code Responsible • lib/action_dispatch/middleware/params_parser.rb •active_support/core_ext/hash/conversions.rb • active_support/xml_mini.rb
- 28.
- 29.
- 30.
- 31. What Now? • geminstall brakeman • Code Climate • Read & subscribe to security blogs • Good coding practices
- 32.
- 33.