yaml is the new eval

YAML is the new eval

@plexusgithub/arnebrasseur

09.02.2013 @rug_b

You

Need to think about security

I'm a Rails developer


I'm not a security expert


I'm not a security expert

That's the point

You Should Be At Defcon 2 For Most Of February

http://bit.ly/you_will_be_compromised

Security

Many aspectsconfidentiality, integrity, availability, authenticity

gem security ?

Emergent PropertyIt's not a feature

Infinity MaximLimitless vulnerabilities, most unknown

Trade offNo such thing as 100% secure

Ignorance is blissIf you believe you're safe,You can assume you're not.

Attack SurfaceYour outer shell

Least AuthorityCan't break what you can't reach

Constrained code

Positive securityWhitelist vs Blacklist

Rails Security

"secure by default"XSS, CSRF, sql escaping, etc.

Tasty MagicProgrammer happiness

People who use magic without knowing what they are doing usually come to a sticky end. All over the entire room, sometimes. ~ Terry Pratchett

What happened?

4 x Rails VulnerabilityRubygems HackedBonus : MySQL feature

Jan 2CVE-2012-5664SQL Injection Vulnerability

Post.find_by_id(id, opts = {})Plain Old Dynamic Finder


Post.find_by_id(:select => sql)I Can Haz Inject SQL?


Post.find_by_id(params[:id])I Can Haz Inject SQL?


Post.find_by_id(params[:id])I Can Haz Inject SQL?


HashWithIndifferentAccess

Exploitable?Probably, but not trivially


AuthLogicUser.find_by_persistence_token(token)


CookieStoresession[:token] = {:select => foo; DROP TABLE ; --}


config.session.keyDo you know where your session key is at 4 o'clock in the morning?


Jan 8CVE-2013-0155Unsafe Query Generation


Foo.find_by_bar( [ nil ] )

JSON or XML payload

Result


Jan 14CVE-2013-0156XML will deserialize YAML

THE BIG ONEWho thought YAML in XML was a good idea anyway?


Never trust YAML!ruby/hash:I::Am::In::Your::Objects!ruby/object:Setting::Your::Ivars


!ruby/hashCalls #[]=


!ruby/objectCalls instance_variable_set


ActionController::Routing::RouteSet::NamedRouteCollectiondef add(name, route) define_named_route_methods(name, route)endalias []= add

def define_url_helper(route, name, kind, options) @module.module_eval

yaml is the new eval

Technology