GitHub Compromised by Mass Assignment Vulnerability
GitHub was recently compromised by a vulnerability in Ruby on Rails know as mass assignment. This vulnerability is thought to not only affect a large number of Ruby-based websites, but also those using ASP.NET MVC and other ORM-backed web frameworks.
Mass assignment by itself is a safe and effective technique for mapping form data to objects. The equivalent in ASP.NET MVC, known as data binding, is likewise safe when used on its own. The actual vulnerability comes from the reckless mixing of mass assignment with an ORM.
Consider this scenario: a database contains a “user” table with a mixture of sensitive and non-sensitive data. Perhaps it has some columns for a user’s display name, email address, and whether or not they are an administrator. A developer wishes to build a screen that allows for editing the display name and email address. To do so they use Rails or MVC scaffolding to automatically generate the domain objects and possibly the view itself. Then they remove from the view any non-user editable fields like the “Is Administrator” checkbox.
A security hole is created if the developer forgets to also remove the IsAdministator property from the domain object. If they don’t do so, the mass assignment/data binder can be tricked into updating that property along with legitimate changes. When the record is then saved, the ORM libraries silently store the new values.
There are three tenable solutions to this problem:
- Flag the non-updatable properties so that the mass assignment/data binder will ignore them.
- Completely remove any properties on the business object that are not actually needed.
- Create models specifically for receiving update requests and manually map them to the ORM object or stored procedure call.
It should be noted that this isn’t a new vulnerability. It is easy to find warnings about mass assignment from four or five more years ago with titles such as “Hackers Love Mass Assignment” and “Use attr_protected or we will hack you”. The only difference this time around is the high-profile nature of the victim.
Maybe this is why Enterprise don't use Rails
6 Ways To Avoid Mass Assignment in ASP.NET MVC
Culture more than tool
Rails can absolutely do that, but if i google up samples, thats not what comes up. THAT is the problem. No different than some languages that for a while would encourage you to escape SQL strings instead of using parameters in queries, leading to SQL injection. Or again in .NET, the <%= construct not escaping stuff by default leading to XSS. They're not vulnerabilities per say, just bad defaults, backed with a bad community culture.
Re: Maybe this is why Enterprise don't use Rails
Re: Culture more than tool
Re: Culture more than tool
Keith Adams Dec 06, 2013