XSS Vulnerability in the escaping function in Ruby on Rails
Aaron Patterson
There is a vulnerability in the escaping code used by Ruby on Rails, using specially crafted malformed unicode strings an attacker can bypass the escaping code. This vulnerability has been assigned the CVE identifier CVE-YYYY-XXXX.
Versions Affected: 2.0.0 and later running on Ruby 1.8.x.
Not Affected: Applications running on Ruby 1.9.x
Fixed Versions: 3.0.10, 2.3.13, 3.1.0.rc5
Impact
------
Ruby on Rails has provided a high performance replacement for ERB::Util.h since version 2.0.0. Due to a bug in the Ruby 1.8 Regular Expression code this replacement version will fail to escape certain malformed unicode strings. This malformed output will then be interpreted as HTML by some browsers on some operating systems.
All users running an affected release should either upgrade or use one of the work arounds immediately.
Releases
--------
The 3.0.10, 2.3.13 and v3.1.0.rc5 releases are available at the normal locations.
Workarounds
-----------
It is possible to construct a before_filter to reject requests which contain invalid parameters, this should only be considered a temporary solution though.
private
before_filter :reject_invalid_requests
def reject_invalid_requests
if include_invalid_utf8?(params)
head :bad_request
end
end
def include_invalid_utf8?(param)
param.any? {|k, v| !validate(k, v)}
end
def validate(*vars)
vars.all? do |var|
case var
when Hash
var[:tempfile].respond_to?(:read) ? true : !include_invalid_char?(var)
when Array
validate(*var)
else
ActiveSupport::Multibyte.verify(var.to_s)
end
end
end
Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.
* 2-3-utf_8.patch - Patch for 2.3 series
* 3-0-utf_8.patch - Patch for 3.0 series
* 3-1-utf_8.patch - Patch for 3.0 series
Please note that only the 2.3.x and 3.0.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible.
Credits
-------
Thanks to Akira Matsuda and Falk Köppe for reporting the vulnerability to us and working with us to confirm a fix.
--
Aaron Patterson
http://tenderlovemaking.com/