Attack Code, Metasploit Module Released For Serious Ruby On Rails Bugs

This just got (more) real: Researchers today unleashed exploit code for a pair of newly found vulnerabilities in the popular Web application programming platform Ruby on Rails (RoR), as well as a new Metasploit module for the most serious of the two flaws, raising concerns of potentially damaging attacks to come on Web servers and databases.

Patches for the two Ruby on Rails vulnerabilities, CVE-2013-0155 and CVE-2013-0156, were issued yesterday after researchers disclosed the bugs earlier this week. Ruby on Rails is an open-source Web programming framework that runs in more than 200,000 websites and on tens of thousands of apps, including Twitter, Metasploit, Groupon, Scribd, Hulu, Living Social, Yellow Pages, and GitHub.

To date, RoR hasn't experienced much in the way of security vulnerability issues, but this new bug finds likely will open the floodgates for more research into holes -- and attacks, security experts say.

Most worrisome is the CVE-2013-0156 bug, which would allow an attacker to execute code remotely on any RoR application that has the XML parser enabled, which is a default setting. The attacker could then steal data from the back-end database, as well as poison the application or website with backdoors and water-hole attacks.

"It's pretty bad," says HD Moore, chief architect of the Metasploit Project, which had to patch its own software for the flaws yesterday. Moore says it's not just the 200,000 sites running on RoR, but also a "huge number of products" running on it that need to be patched.

Moore and his team found themselves in the strange position of having to patch for a flaw that they would then weaponize with an RoR exploit in Metasploit. "Everyone missed it -- our internal and external coders," Moore says of the RoR bugs in Metasploit.

While there were no known attacks as of this posting, security experts still worry that organizations with fewer resources or knowledge of what they have running on RoR will apply the patches soon enough. "I'm still very concerned about [this flaw]," says Adam O'Donnell, chief architect for the cloud technology group at Sourcefire, who yesterday posted a blog laying out the ramifications of these bugs. The server bugs could be abused with worm attacks, he said, or even worse, with attacks that silently infiltrate a large number of websites and steal information from their databases, or plant backdoors or water-hole attacks that target site visitors.

"I think the one saving grace we do have is people who generally use Ruby on Rails as their Web programming framework are also hooked into a development philosophy where they rapidly roll out changes. They are doing multiple revisions to the Web front-end in a single day," O'Donnell says. "They already have this development practice in place of pushing out changes very quickly. So my hope is that this will be cleaned up relatively quickly compared to other technologies out there."

O'Donnell says he has seen programmers at several organizations, including Sourcefire itself, drop everything and patch the RoR-based systems. "Whenever you see an exploit as a remote preauthorization code execution vulnerability, you have to drop everything to fix it," he says. "Anything that can just connect to you and attack you without a username and password and run any code it wants to is a bad situation.

"That's the reason people raised the alarm bells so quickly," he says.

Finding all RoR apps that an organization touches can be tricky, however. "Ruby on Rails is a popular framework for a lot of Web 2.0 apps, [such as] the various Twitter add-on sites and social media aggregators," says Moore, who is CSO of Rapid7.

"In many cases, the Ruby on Rails app may not be accessible from the main URL of a website, but instead mapped in a subdirectory, like '/forums' or '/dashboard.' So when scanning for RoR applications, it requires doing more than just hitting up every Web server on the front page. In many cases, you have to crawl the site, or go login to the server and look," Moore says.

Ruby on Rails, meanwhile, has basically become the "lingua franca" for startups, notes Sourcefire's O'Donnell. "The reason you don't see as many vulns in Ruby on Rails as you do in older programming frameworks is that there were a lot of lessons learned [from those platforms] applied to what we have today" with RoR, he says. "Ruby on Rails is definitely a platform that enforces good coding habits. It's been shown to lead to better security practices."

Security experts recommend patching RoR apps now if you have not already done so. Said O'Donnell in a blog post yesterday: "If you are running Rails code, stop what you are doing and upgrade your Rails environment right now. If you are managing people who are writing Rails code, get them to upgrade their environment immediately. If you are a web hoster that has a significant number of people running Rails code, contact your customers and get them to upgrade. Order lunch in. Don’t go home. Stop reading this and fix the problem. You get the idea."

Moore, who also posted a blog yesterday with technical details on the vulnerabilities, says he expects to see more RoR attacks as more applications run on the platform.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.