XSS Vulnerability in Ruby on Rails

Posted by michael September 04, 2009 @ 05:41 AM

There is a vulnerability in the escaping code for the form helpers in Ruby on Rails. Attackers who can inject deliberately malformed unicode strings into the form helpers can defeat the escaping checks and inject arbitrary HTML.

Versions Affected:  2.0.0 and *all* subsequent versions.
Not affected:       Applications running on ruby 1.9
Fixed Versions:     2.3.4, 2.2.3
Candidate CVE:      CVE-2009-3009

Impact

Due to the way that most databases either don’t accept or actively cleanse malformed unicode strings this vulnerability is most likely to be exploited by non-persistent attacks however persistent attacks may still be possible in some configurations.

All users of affected versions are advised to upgrade to a fixed versions.

Releases

The 2.3.4 and 2.2.3 releases will be made available shortly and contain fixes for this issue.

Patches

In order to provide the fixes for users who are running unsupported releases, or are unable to upgrade at present we have provided patches against all affected stable release branches.

The patches are in a format suitable for git-am and consist of two changesets. The code for cleansing multi-byte strings, and the introduction of that code to the relevant helpers.

Please note that only the 2.2.x and 2.3.x series are supported at present. Users of earlier unsupported releases are advised to upgrade sooner rather than later as we cannot guarantee that future issues will be backported in this manner.

Credits

Thanks to Brian Mastenbrook for reporting the vulnerability to us, and Manfred Stienstra from Fingertips for his work with us on the fix.

16 comments

Comments

Leave a response

  1. Nick on 04 Sep 08:00:

    How do I apply a patch to frozen Rails within an old project?

  2. Valentin on 04 Sep 08:07:

    Nick: how about unfreezing it, updating and freezing again?

  3. Manfred Stienstra on 04 Sep 08:25:

    Nick, if you have git installed you can do the following:

    $ cd vendor/rails $ git apply <name-of-patch>

    Make sure you get the patch for your version of Rails, otherwise it might not apply.

  4. Nick on 04 Sep 09:10:

    Thx Manfred, the patch links above don’t seem to be in the right format for that? Nothing happens when I use git apply :(

  5. Dominiek ter Heide on 04 Sep 09:32:

    Aahrgh,

    Can someone add a decently formatted patch?

  6. Michael on 04 Sep 12:45:

    Can this be made available as a regular unix patch file for those of us not schooled in git?

  7. Cassidy on 04 Sep 12:46:

    Dominiek – the patch worked for me.

    cd vendor/rails patch -p1 < 2-2-CVE-2009-3009.patch

  8. Nick on 04 Sep 12:58:

    Thx for those instructions Cassidy. Worked for me.

  9. Bill on 04 Sep 18:17:

    +1 on Cassidy’s instructions working. Thanks Cassidy!

  10. Tom Copeland on 04 Sep 21:21:

    If the gems aren’t frozen (e.g., they’re out there in /usr/local/lib/) you can apply the patch using symlinks; more details here:

    http://tomcopeland.blogs.com/juniordeveloper/2009/09/applying-the-rails-xss-vulnerability-patch.html

  11. mp on 04 Sep 21:38:

    What would be the reason for not patching the gems in the github repo?

  12. Vinay on 05 Sep 06:09:

    Does using something like the xss_terminate plugin override this vulnerability?

  13. Nobu Nakada on 09 Sep 01:16:

    Why don’t you use: /\A.\z/ =~ string or Regexp.new(’\A.\z’, $KCODE) =~ string ?

  14. Nobu Nakada on 09 Sep 01:27:

    Oops, how can I write a literal asterisk?

  15. Alex on 14 Sep 17:06:

    I’m trying to apply the patch using Cassidy’s instructions, but for Rails v2.1.2

    When I run the following in my vendor/rails folder: patch -p1 < 2-1-CVE-2009-3009.patch

    The output I get is: patch: ** Only garbage was found in the patch input.

    Does anyone have any ideas on how I can get the patch installed?

  16. chris on 17 Sep 18:58:

    Hi,

    i liked your article very much, and i would also like to point out another article on this blog ->

    http://hackerthedude.blogspot.com/2009/09/xss-phishing.html

    Thanks

Ruby on Rails was created by David Heinemeier Hansson, a partner at 37signals,
then extended and improved by a core team of committers and hundreds of open-source contributors.

Rails is released under the MIT license. Ruby under the Ruby License.

"Rails", "Ruby on Rails", and the Rails logo are trademarks of David Heinemeier Hansson. All rights reserved.

Sponsored by

 37signals