XSS Vulnerability in the escaping function in Ruby on Rails

668 views
Skip to first unread message

Aaron Patterson

unread,
Aug 16, 2011, 5:05:44 PM8/16/11
to rubyonrail...@googlegroups.com
XSS Vulnerability in the escaping function in Ruby on Rails

There is a vulnerability in the escaping code used by Ruby on Rails, using specially crafted malformed unicode strings an attacker can bypass the escaping code. This vulnerability has been assigned the CVE identifier CVE-YYYY-XXXX.

Versions Affected: 2.0.0 and later running on Ruby 1.8.x.
Not Affected: Applications running on Ruby 1.9.x
Fixed Versions: 3.0.10, 2.3.13, 3.1.0.rc5

Impact
------
Ruby on Rails has provided a high performance replacement for ERB::Util.h since version 2.0.0. Due to a bug in the Ruby 1.8 Regular Expression code this replacement version will fail to escape certain malformed unicode strings. This malformed output will then be interpreted as HTML by some browsers on some operating systems.

All users running an affected release should either upgrade or use one of the work arounds immediately.

Releases
--------
The 3.0.10, 2.3.13 and v3.1.0.rc5 releases are available at the normal locations.

Workarounds
-----------

It is possible to construct a before_filter to reject requests which contain invalid parameters, this should only be considered a temporary solution though.

private
before_filter :reject_invalid_requests

def reject_invalid_requests
if include_invalid_utf8?(params)
head :bad_request
end
end

def include_invalid_utf8?(param)
param.any? {|k, v| !validate(k, v)}
end

def validate(*vars)
vars.all? do |var|
case var
when Hash
var[:tempfile].respond_to?(:read) ? true : !include_invalid_char?(var)
when Array
validate(*var)
else
ActiveSupport::Multibyte.verify(var.to_s)
end
end
end


Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

* 2-3-utf_8.patch - Patch for 2.3 series
* 3-0-utf_8.patch - Patch for 3.0 series
* 3-1-utf_8.patch - Patch for 3.0 series

Please note that only the 2.3.x and 3.0.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible.

Credits
-------

Thanks to Akira Matsuda and Falk Köppe for reporting the vulnerability to us and working with us to confirm a fix.

--
Aaron Patterson
http://tenderlovemaking.com/

2-3-utf_8.patch
3-0-utf_8.patch
3-1-utf_8.patch
Reply all
Reply to author
Forward
0 new messages