Web app framework Ruby on Rails patched two security flaws this week in the open source framework that could have led to denial of service attacks and remote execution vulnerabilities.
With builds 3.2.12, 3.1.11 and 2.3.17, the framework fixed a serialized attributes YAML vulnerability (CVE-2013-0277) that could have let developers give users access to the +serialize+ helper in ActiveRecord. From there an attacker could have used a specially crafted request to trick the function into deserializing arbitrary YAML data, potentially leading to remote code execution.
The update also fixes another problem (CVE-2013-0276) in the framework’s ActiveRecord function, this one with its attr_protected method. Attackers could have bypassed the protection and alter values that were meant to be protected, according to an alert issued by Ruby on Rails contributer Aaron Patterson on Monday.
Users of the framework are encouraged to apply the new patches – available here – and when it comes to the second vulnerability, are advised to replace the attr_protected whitelist with the attr_accessible whitelist, which isn’t vulnerable
It was only two weeks ago that Ruby on Rails patched its last JSON vulnerability, a problem that stemmed from the way the function parsed YAML code.