Web app framework Ruby on Rails patched two security flaws this week in the open source framework that could have led to denial of service attacks and remote execution vulnerabilities.
With builds 3.2.12, 3.1.11 and 2.3.17, the framework fixed a serialized attributes YAML vulnerability (CVE-2013-0277) that could have let developers give users access to the +serialize+ helper in ActiveRecord. From there an attacker could have used a specially crafted request to trick the function into deserializing arbitrary YAML data, potentially leading to remote code execution.
The update also fixes another problem (CVE-2013-0276) in the framework’s ActiveRecord function, this one with its attr_protected method. Attackers could have bypassed the protection and alter values that were meant to be protected, according to an alert issued by Ruby on Rails contributer Aaron Patterson on Monday.
Users of the framework are encouraged to apply the new patches – available here – and when it comes to the second vulnerability, are advised to replace the attr_protected whitelist with the attr_accessible whitelist, which isn’t vulnerable
A post on Ruby on Rails’ blog notes that a new JavaScript Object Notation (JSON) gem was also released this week. That gem contains a security fix for a flaw (CVE-2013-0269) could’ve allowed denial of service attacks and “be used as a spring board” for SQL injection attacks, according to a subsequent alert.
It was only two weeks ago that Ruby on Rails patched its last JSON vulnerability, a problem that stemmed from the way the function parsed YAML code.
