dfcarney

"Thank you, our customers, for believing in us." is such an obnoxious and insincere statement. If anything, their customers only went with them because StackMob gave assurances (or at least the impression) of stability. I wish they were just upfront, sincere, and a bit apologetic.

Their server is down. Here's the content:

-- by Rohit Sethi on February 13, 2013 -- http://blog.sdelements.com/author/rohit/

The latest Rails security flaw [1] is example of a common anti-pattern. Ned Batchelder wrote an awesome post [2] explaining how a similar issue may also exist in Python’s YAML parser [3]. Looking at these vulnerabilities, I am reminded of similar flaws in other frameworks and libraries.

The issue in each case is an abuse of extensibility. At first glance the idea is clever: allow for run-time execution of new code or binding of server-side variables without changing your compiled code, thereby greatly enhancing extensibility. For example, provide extensions to your Python YAML parser that allow you to create arbitrary objects and execute Python code; provide extensions to XML Template parsing that allows for arbitrary command execution [4]; or dynamically assign user-supplied parameters to server-side variables [5] (aka mass assignment) based on the parameter name. This kind of vulnerability is by design in contrast to many other by accident vulnerabilities. We called the mass assignment anti-pattern out [6] several years ago when doing a security analysis of the Core Java EE Patterns for OWASP.

I have a strong feeling we’ll see more vulnerabilities of this type, particularly with the rising popularity of standards like SAML that are built upon several layers of libraries implementing and extending complex specifications. These kind of issues can sometimes be hard to catch with an automated scanning technology, which means most organizations adopting the status quo of application security due diligence [7] will undoubtedly miss detecting some instances of extensibility abuse.

Security-minded developers can protect themselves by taking the following steps:

Turn off unnecessary extensibility in third party libraries and frameworks Do not use untrusted input in libraries that provide broad extensibility, such as Apache’s Xalan [8] with extensions enabled.

Be vigilant about monitoring for and patching newly discovered vulnerabilities in frameworks and third party libraries. Wherever possible, sign up for security mailing lists or groups like Ruby on Rails Security [9]

[1] http://www.zweitag.de/en/blog/ruby-on-rails-vulnerable-to-ma... [2] http://nedbatchelder.com/blog/201302/war_is_peace.html [3] http://pypi.python.org/pypi/PyYAML [4] http://labs.securitycompass.com/tutorials/xslt-command-execu... [5] http://www.codeproject.com/Articles/471784/Exploiting-Micros... [6] https://www.owasp.org/index.php/Category:OWASP_Security_Anal... [7] http://blog.sdelements.com/raising-the-bar-on-application-se... [8] http://xml.apache.org/xalan-j/extensions.html [9] https://groups.google.com/forum/?hl=en&fromgroups#!forum...