Hacker News new | ask | show | jobs
by nfm 3801 days ago
Doesn't look too bad, although there are a lot of CVEs to go through:

- A timing attack if you're using HTTP basic auth

- A couple of GC related DoS attacks

- An issue with `accepts_nested_attributes_for` if you're using both the `allow_destroy` and `reject_if` options

- A validation bypass exploit if you're calling `SomeModel.new(params[:some_model])` instead of using StrongParams

- An information leak exploit if you're calling `render params[:something]` with raw user input

- A bunch of potential XSS exploits

The `render` issue looks like it could cause the most harm, but hopefully shouldn't be too prevalent. The XSS issues should be a quick fix as you only have to update `rails-html-sanitizer`, not Rails itself.

2 comments

>- A timing attack if you're using HTTP basic auth

I'd say that qualifies as pretty bad.

How the hell does that even happen? Using time constant string comparison is authentication 101. That's really not something you can mess up by mistake, it's something you mess up by not understanding what you're doing. And that's is all ignoring the fact that there's no reason to not use hashing here.

The vast majority of rails applications do not use HTTP basic authentication, and I would guess that most of the ones that do use nginx or apache to provide it. This was probably not caught until now because hardly anyone uses it.
I've seen a bunch of companies use rails HTTP basic auth internally.

And it's not that it wasn't caught until now, it's that it wasn't caught before the commit was accepted.

I expect (though I have not looked) that it's old code that wasn't eyeballed for security so much as for consistency and correctness. Once in, it doesn't leave.
I imagine every app on Heroku which uses basic auth is at risk then.
Turns out, deciding how to compare two strings when they may be differing lengths is tricky.
Do we really need CVE numbers assigned for all of these? More or less every application out there is vulnerable to some form of timing attack