Circumvent Rails CSRF Protection


There is a security-related bug in Ruby on Rails 2.1.x and all 2.2. pre-releases. The CSRF protection given by
the protect_from_forgery method may possibly be circumvented by a crafted request.

The problem is that Rails by design will not check the authenticity token if the request has certain content types that are typically not generated by browsers. According to the original security message, this list also includes "text/plain" which may be generated by browsers. This form data encoding roundup gives an overview of what can be generated by today's browsers. See this changset for details of which content types will be checked.

 

Possible Exploit

The content type can be set with the enctype attribute in HTML forms:

<form method="post" enctype="text/plain" action="<%= some_post_action_path(@var) %>"><%= submit_tag "Start" %></form>

This was found in this Lighthouse ticket. The original security message states that Rails does not parse the parameters for these requests. However, I was able to craft requests where all parameters where correctly parsed and used.

 

Temporary Solution

Users of 2.1.x releases are advised to insert the following code into a file in config/initializers/

Mime::Type.unverifiable_types.delete(:text)

Or you apply this patch for the 2.1.x releases. Users of Edge Rails should upgrade to the latest version.

 

Fixes

Fixes will be in Rails version 2.1.3 and 2.2.2.

Rails Security Guide and Book


That's it, the Ruby on Rails Security guide is ready. It is available as a Rails manual at http://guides.rubyonrails.org/security.html and as a free e-book at http://www.rorsecurity.info/the-book/. The first batch of the new Rails Guides also includes 14 other quality manuals ranging from "Getting started", routing, testing and debugging.

So far, the online version of the guide is one long page, I hope it will be seperated soon. Meanwhile you can read the e-book version of it. For those of you looking for a quick overview of good practice and countermeasures, scan the document for the fragments that are highlighted.

I will be officially announcing the Guide at the OWASP EU Summit in Portugal this week.

Header Injection And Response Splitting

I thought about the redirect_to method when I saw Ryan's screencast of how to go back with redirect_to :back. That way the user will be redirected to the URL from the Referer header field, it's the same as redirect_to request.referer. The Referer is a user-supplied value which is set by the browser or another user-agent. It should not be possible to spoof the Referer in an Ajax request, but some browsers seem to allow it (Firefox does not).

An attack on this is quite unlikely. However if the attacker manages to manipulate the Referer, the victim will be redirected to another site. This site may install malicious software on the victim's computer through browser security holes. Or it could be a phishing site that asks the victim to enter his username and password.

Then I saw comment #11 which suggests to put the referer into a hidden field:

<%= hidden_field_tag :referer, (params[:referer] || request.env['HTTP_REFERER']) %>

The hidden_field_tag method automatically escapes the value, so it is not vulnerable to XSS. However, be aware of XSS if you use the params otherwise.

More important is that you would use redirect_to params[:referer]. This is a very nice redirector for any URL you like. If the attacker sets the params[:referer] value by supplying the parameter to the site with the hidden_field_tag from above, the victim will be redirected to any desired page:

http://www.yourapplication.com/controller/action?referer=http://www.malicious.tld

Header Injection

Then there is a another problem with user-supplied values in the HTTP headers: Header Injection. It seems that Ruby/Rails does not sanitize the parameter passed to redirect_to. That means the user may set any header field he likes:

http://www.yourapplication.com/controller/action?referer=http://www.malicious.tld%0a%0dX-Header:+Hi!

Note that "%0d%0a" is URL-encoded for "\r\n" which is a carriage-return and line-feed in Ruby. So the resulting HTTP header will be:

HTTP/1.1 302 Moved Temporarily
(...)
Location: http://www.malicious.tld
X-Header: Hi!

And even if you allow the user to supply only parts of the target URL, the attacker may still overwrite the Location header field (and thus redirect to any site he wants):

http://www.yourapplication.com/controller/action?referer=path/at/your/app%0aLocation:+http://www.malicious.tld

Response Splitting

As Header Injection is possible, Response Splitting might be, too. In HTTP, the header block is followed by two carriage-return, line-feeds (CRLF) and the actual data (usually HTML). The idea of Response Splitting is to inject two CRLFs, followed by another response with malicious HTML. The response will be:

HTTP/1.1 302 Found [First standard 302 response]
Date: Tue, 12 Apr 2005 22:09:07 GMT
Location:
Content-Type: text/html

HTTP/1.1 200 OK [Second New response created by attacker begins]
Content-Type: text/html

<html><font color=red>hey</font></html> [Arbitary input by user is shown as the redirected page]
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

Read the original article here. Under certain circumstances this would present the malicious HTML to the user. However, this seems to work with Keep-Alive connections, only (and many browsers are using one-time connections). But you can't rely on this. In any case this is a serious bug, and you should update your Rails to version 2.0.5 or the soon-to-be-released 2.1.2.

FREE CEU’s in Ohio!

10/21 – 1 – 4:15 Lying & Stealing “The Sneaky Disorder”
10/22 – 1 – 4:15 Serious Emotional Disturbances in Chn. & Adol. – need 6

10/23 – 1 – 4:15 The Impact of Loss and Grief – need 3
10/31 – 8:45 – 4:15 Developing a Medical Mindset: Casework Concerns for Chn. w/Special Healthcare needs – need 8
11/5 – 8:45 – 4:15 Verbal De-Escalation – need 7
11/10 – 1 – 4:15 Conflict Mgmt. – need 3
11/14 – 8:45 – 4:15 A Toolbox for Meeting Facilitators – Part 1 – need 10
11/19 – 1:00 – 4:15 What Do Mental Health Diagnoses Mean, and What Do We Do? – need 6
11/20 – 1:00 – 4:15 Teen Culture and Generation Y – need 6
11/21 – 1:00 – 4:15 The Depressed Child and Teen – need 3
12/8 – 8:45 – 4:15 TWO DAY – 12 HRS – Personal Safety Defense (VERY HIGHLY RATED ON EVALS) need 7
12/10 – 1 – 4:15 I’m an Individual; Chn. & Young People w/Disabilities Need 12
12/11 – 8:45 – 4:15 Revised Internet Addiction AND De-Escalation – need 3
12/16 – 8:45 – 4:15 Human Trafficking (VERY HIGHLY RATED AS WELL) need 1
12/18 – 8:45 – 4:15 A Toolbox for Meeting Facilitators – Part II – need 10
The sooner you register, the better as it helps for those who may need to find alternate trainings if the class size doesn’t increase. Thank you.

> >HOW TO REGISTER FOR TRAININGS WITH LCCS USING ACTEVAWe have an on-line training registration program that you can use to register for trainings called Acteva. In your subject line, type in www.childrenservices.org and then click on training, training calendar, it takes you to a calendar. Once you see the calendar, you’ll see arrows next to the name of the month, click on the arrows to advance through the months if you don’t see a training you want in the current month. Once you find the training that you’re interested in, click on the underlined training. NOTE: As a new user, once you’re in our system, a screen that says “MyActeva” will come up. The system wants you to create a user name and password (please note it is case sensitive so please be careful if you use upper and lower case). It may tell you that, that name is already in use, choose something else but whatever you choose, please write it down as I won’t have access to that information. Once you’ve typed in the password, and hit continue, you’ll fill in a page of your demographics only once. Any time you want to register after that, you’ll just click on the trainings that you are interested in, it will ask you to confirm and it will send the confirmation to your email and my email.

Just a note, when you want to register for a training that’s “sold out”, you can still register but where it says “order”, it will say “wait” which means you’ll be on a waiting list. Should someone cancel, I go through the list in the order that the requests come in and will make a call or email you asking if you’re still interested in attending.

Also, you will see in the calendar some of the trainings will be all capitalized, (CORE, SPECIALIZED, ADOPTION ASSESSOR, SUPERVISOR CORE), those are trainings that are specifically for Lorain County Children Services staff. You will also see trainings that start off with “Foster Parent Trainings”, those are designed specifically for our foster parents. The other trainings that you probably are interested in will just start off with the title of the training, they are free and available to everyone. Please note that the CEU’s are social worker CEU’s.

Just an FYI, when you are entering in your demographics into your “MyActeva” account, please be sure to include an alternate number in any available cell just in case we need to cancel due to weather, emergency, etc. It’s also helpful to check your email that you registered with in the morning just in case we do cancel. I will give the trainers my home number so they can contact me asap if there is a cancellation. I will then email registrants and try to call to advise you if there is a cancellation. Please note, even though Spitzer’s is located within Lorain County Community College, if the college closes, Spitzer’s does not. If the trainer cancels the training due to weather, I’ll will call and email you.

IF YOU MOVE, CHANGE YOUR NAME, PHONE NUMBER/S OR EMAIL ADDRESS, PLEASE GO INTO YOUR “MYACTEVA” ACCOUNT AND DO AN EDIT TO ENSURE THAT YOU WILL RECEIVE YOUR CERTIFICATE WITH THE MOST ACCURATE INFORMATION.

PLEASE NOTE: WHEN YOU CONFIRM A TRAINING IN ACTEVA, DON’T CLICK IT AGAIN DURING THE PROCESSING AS YOU DOUBLE REGISTER. IT WILL COME MOVE YOU ON.

It really is very user friendly but if you need assistance, please email or call me and I’ll get back with you to assist you in the process. DeborahTyras@childrenservices.org or (440) 329-5774.

FREE CEU

10/21 – 1 – 4:15 Lying & Stealing “The Sneaky Disorder”
10/22 – 1 – 4:15 Serious Emotional Disturbances in Chn. & Adol. – need 6

10/23 – 1 – 4:15 The Impact of Loss and Grief – need 3
10/31 – 8:45 – 4:15 Developing a Medical Mindset: Casework Concerns for Chn. w/Special Healthcare needs – need 8
11/5 – 8:45 – 4:15 Verbal De-Escalation – need 7
11/10 – 1 – 4:15 Conflict Mgmt. – need 3
11/14 – 8:45 – 4:15 A Toolbox for Meeting Facilitators – Part 1 – need 10
11/19 – 1:00 – 4:15 What Do Mental Health Diagnoses Mean, and What Do We Do? – need 6
11/20 – 1:00 – 4:15 Teen Culture and Generation Y – need 6
11/21 – 1:00 – 4:15 The Depressed Child and Teen – need 3
12/8 – 8:45 – 4:15 TWO DAY – 12 HRS – Personal Safety Defense (VERY HIGHLY RATED ON EVALS) need 7
12/10 – 1 – 4:15 I’m an Individual; Chn. & Young People w/Disabilities Need 12
12/11 – 8:45 – 4:15 Revised Internet Addiction AND De-Escalation – need 3
12/16 – 8:45 – 4:15 Human Trafficking (VERY HIGHLY RATED AS WELL) need 1
12/18 – 8:45 – 4:15 A Toolbox for Meeting Facilitators – Part II – need 10
The sooner you register, the better as it helps for those who may need to find alternate trainings if the class size doesn’t increase. Thank you.

> >HOW TO REGISTER FOR TRAININGS WITH LCCS USING ACTEVAWe have an on-line training registration program that you can use to register for trainings called Acteva. In your subject line, type in www.childrenservices.org and then click on training, training calendar, it takes you to a calendar. Once you see the calendar, you’ll see arrows next to the name of the month, click on the arrows to advance through the months if you don’t see a training you want in the current month. Once you find the training that you’re interested in, click on the underlined training. NOTE: As a new user, once you’re in our system, a screen that says “MyActeva” will come up. The system wants you to create a user name and password (please note it is case sensitive so please be careful if you use upper and lower case). It may tell you that, that name is already in use, choose something else but whatever you choose, please write it down as I won’t have access to that information. Once you’ve typed in the password, and hit continue, you’ll fill in a page of your demographics only once. Any time you want to register after that, you’ll just click on the trainings that you are interested in, it will ask you to confirm and it will send the confirmation to your email and my email.

Just a note, when you want to register for a training that’s “sold out”, you can still register but where it says “order”, it will say “wait” which means you’ll be on a waiting list. Should someone cancel, I go through the list in the order that the requests come in and will make a call or email you asking if you’re still interested in attending.

Also, you will see in the calendar some of the trainings will be all capitalized, (CORE, SPECIALIZED, ADOPTION ASSESSOR, SUPERVISOR CORE), those are trainings that are specifically for Lorain County Children Services staff. You will also see trainings that start off with “Foster Parent Trainings”, those are designed specifically for our foster parents. The other trainings that you probably are interested in will just start off with the title of the training, they are free and available to everyone. Please note that the CEU’s are social worker CEU’s.

Just an FYI, when you are entering in your demographics into your “MyActeva” account, please be sure to include an alternate number in any available cell just in case we need to cancel due to weather, emergency, etc. It’s also helpful to check your email that you registered with in the morning just in case we do cancel. I will give the trainers my home number so they can contact me asap if there is a cancellation. I will then email registrants and try to call to advise you if there is a cancellation. Please note, even though Spitzer’s is located within Lorain County Community College, if the college closes, Spitzer’s does not. If the trainer cancels the training due to weather, I’ll will call and email you.

IF YOU MOVE, CHANGE YOUR NAME, PHONE NUMBER/S OR EMAIL ADDRESS, PLEASE GO INTO YOUR “MYACTEVA” ACCOUNT AND DO AN EDIT TO ENSURE THAT YOU WILL RECEIVE YOUR CERTIFICATE WITH THE MOST ACCURATE INFORMATION.

PLEASE NOTE: WHEN YOU CONFIRM A TRAINING IN ACTEVA, DON’T CLICK IT AGAIN DURING THE PROCESSING AS YOU DOUBLE REGISTER. IT WILL COME MOVE YOU ON.

It really is very user friendly but if you need assistance, please email or call me and I’ll get back with you to assist you in the process. DeborahTyras@childrenservices.org or (440) 329-5774.

New RedCloth security

RedCloth is a module for using Textile in Ruby. Textile is a simple text format that can be converted to HTML, eliminating the need to use HTML directly to create documents, blogs, or web pages.

The new version 4 promises to be faster and without the bugs from version 3. And indeed it feels more reliable and many of the earlier security concers have now been dealt with. For example:

RedCloth.new("<script>alert(1)</script>").to_html

now returns

&lt;script&gt;alert(1)&lt;/script&gt;

instead of

<script>alert(1)</script>

in earlier versions. And it's good that it escapes the input instead of deleting malicious parts. I tried many examples from the XSS cheatsheet and hand-crafted ones. The result is that nearly no malicious parts get through. Yes nearly.

The <code> tag gets through:

RedCloth.new('<code onmouseover="bad_code_here">asdf</code>', [:filter_html]).to_html
<code onmouseover="bad_code_here">asdf</code>

I've created a ticket for that.

And comments get through:

RedCloth.new("<!--[if gte IE 4]><SCRIPT>alert('XSS');</SCRIPT><![endif]-->", [:sanitize_html]).to_html

renders

"<p><!--[if gte IE 4]>alert('XSS');<![endif]--></p>"

which works in some browsers according to the XSS Cheatsheet.

Also remember that CSS injection will work in textile, if you allow styles. See the earlier post for that.

Nevertheless the new version is far better. And in combination with a whitelist (namely Rails' sanitize() method) it is even secure.

The updated Rails Security Guide

I'm taking part in the Rails Guide Hackfest which is "an attempt to improve Rails documentation and make the barrier to entry as low as possible."

You can take a look at it here: http://guides.rails.info/securing_rails_applications/security.html

If you find a typo or if you'd like to contribute, the Lighthouse ticket is here:
http://rails.lighthouseapp.com/projects/16213/tickets/7

What are you good and bad learning experiences?

I am making a poster on good and bad learning experiences for college.
It would be a great help if you could answer the question above.
What have you found best for learning and the worst for learning?
What distracts you and what encourages you?
Do you learn better in different environments and if so which ones?
Can you give examples of times when you have had a good learning experience or even a bad one?
Thanks a bunch everyone :)
distractions are:

peers
forms of entertainment like video games,internet,etc
dilapidated rooms
big number of students in the room
family problems

motivations are:
- good grades / awards/honors
- bright future
- nice job
-realization of dreams
- boyfriends and girlfriends are inspiration too as well as our families