Ruby on Rails Security Flaw Severe, but Not Widespread: Researcher
A security researcher finds a way to steal information from Web applications designed with Ruby on Rails and using a third-party authentication mechanism.The developers for Ruby on Rails fixed a subtle bug in the Web development framework that could allow an attacker to take control of an application's database by SQL injection. While the impact of the bug could be severe, most applications are not vulnerable unless they use Authlogic, a third-party authentication framework, and have exposed their secret session key. Most applications developed in-house will not be vulnerable, as their developers have generated a secret hash-based message authentication code (HMAC) to act as the key or password for the application's security, Hongli Lai, chief technology officer for Ruby development firm Phusion, wrote in an analysis of the vulnerability. Yet, publicly available applications deployed by administrators without changing the key could be exploitable, he said. "Open-source Rails apps, however, can form a problem," Lai stated. "Many of them come with a default session secret, but the user never customizes them, so all those instances end up using the same HMAC key, making them very easily exploitable."
Ruby on Rails is a Web application development framework based on Ruby, a language designed to minimize programmer confusion and maximize code reuse. Ruby on Rails is known for its ability to help Web users quickly prototype new sites and applications and is best known as the framework used to build the Basecamp project management system and Twitter's online site.