Today there were four Ruby on Rails security vulnerabilities announced. In this post we’ll give you the basics on each and help you determine if you need to take action on your Ruby on Rails site to address these vulnerabilities.
If you have any questions about these vulnerabilities please contact us.
CVE-2011-0446 – Potential XSS Problem with mail_to :encode => :javascript
This vulnerably can allow an attacker to circumvent the Cross-Site Request Forgery mechanism inside Ruby on Rails.
This issue is likely to affect many 2.3.x and 3.x users, and thus we recommend applying the patch found at the above link. There are no workarounds known at this time.
CVE-2011-0449 - Filter Problems on Case-Insensitive Filesystems
This vulnerability can allow attackers to circumvent filters in your application. This can be a potentially devastating impact, but it only applies to Rails applications using Ruby on Rails 3.x (2.x or 1.x series aren’t affected) on file systems that are case-insensitive.
This means that all Rails applications hosted by OCS Solutions are presumed safe from this issue, because we use Linux and ext3/ext4 based filesystems which are case sensitive.
If you run your Rails application in production on a Windows server (thought I wouldn’t advise that anyway), you are advised to click the link above and apply the patch.
CVE-2011-0448 - Potential SQL Injection in Rails 3.0.x
This vulnerability allows an attacker to potentially perform an SQL injection on a Rails 3 application. This can be serious, and users of Rails 3.x are advised to upgrade to Rails 3.0.4 immediately. We’ll be installing Rails 3.0.4 on all of our servers over the next 2-3 days but you may use 3.0.4 immediately by freezing Rails 3.0.4 to your application and redeploying.
Note that Rails 1.x and 2.x users are unaffected by this issue.
A workaround is available as well at the above link, but given the ease of upgrade from 3.x to 3.0.4 an upgrade to 3.0.4 is recommended.
CVE-2011-0447 – CSRF Protection Bypass in Ruby on Rails
This issue allows the Cross-Site Request Forgery protection included in Ruby on Rails 2.1.x and above (including the 3.x series) to be circumvented in certain cases.
A patch has been included in the above link and all users with Rails applications using versions 2.1.x and above are encouraged to either use it or upgrade to 2.3.11 (if you’re using the 2.x series) or 3.0.4 (if you’re using the 3.x series). We’ll be installing these versions on our servers over the next 2-3 days but you may use these new versions immediately by freezing 2.3.11 or 3.0.4 to your application and redeploying.
