GitHub Compromised by Mass Assignment Vulnerability
- Share
-
- |
Read later
Reading List

A note to our readers: You asked so we have developed a set of features that allow you to reduce the noise: you can get email and web notifications for topics you are interested in. Learn more about our new features.
GitHub was recently compromised by a vulnerability in Ruby on Rails know as mass assignment. This vulnerability is thought to not only affect a large number of Ruby-based websites, but also those using ASP.NET MVC and other ORM-backed web frameworks.
Mass assignment by itself is a safe and effective technique for mapping form data to objects. The equivalent in ASP.NET MVC, known as data binding, is likewise safe when used on its own. The actual vulnerability comes from the reckless mixing of mass assignment with an ORM.
Consider this scenario: a database contains a “user” table with a mixture of sensitive and non-sensitive data. Perhaps it has some columns for a user’s display name, email address, and whether or not they are an administrator. A developer wishes to build a screen that allows for editing the display name and email address. To do so they use Rails or MVC scaffolding to automatically generate the domain objects and possibly the view itself. Then they remove from the view any non-user editable fields like the “Is Administrator” checkbox.
A security hole is created if the developer forgets to also remove the IsAdministator property from the domain object. If they don’t do so, the mass assignment/data binder can be tricked into updating that property along with legitimate changes. When the record is then saved, the ORM libraries silently store the new values.
There are three tenable solutions to this problem:
- Flag the non-updatable properties so that the mass assignment/data binder will ignore them.
- Completely remove any properties on the business object that are not actually needed.
- Create models specifically for receiving update requests and manually map them to the ORM object or stored procedure call.
It should be noted that this isn’t a new vulnerability. It is easy to find warnings about mass assignment from four or five more years ago with titles such as “Hackers Love Mass Assignment” and “Use attr_protected or we will hack you”. The only difference this time around is the high-profile nature of the victim.
Rate this Article
- Editor Review
- Chief Editor Action
Hello stranger!
You need to Register an InfoQ account or Login or login to post comments. But there's so much more behind being registered.Get the most out of the InfoQ experience.
Tell us what you think
Maybe this is why Enterprise don't use Rails
by
Bruno Borges
Really?
6 Ways To Avoid Mass Assignment in ASP.NET MVC
by
Jonathan Allen
odetocode.com/Blogs/scott/archive/2012/03/11/co...
Culture more than tool
by
Francois Ward
Rails can absolutely do that, but if i google up samples, thats not what comes up. THAT is the problem. No different than some languages that for a while would encourage you to escape SQL strings instead of using parameters in queries, leading to SQL injection. Or again in .NET, the <%= construct not escaping stuff by default leading to XSS. They're not vulnerabilities per say, just bad defaults, backed with a bad community culture.
Re: Maybe this is why Enterprise don't use Rails
by
Jonathan Allen
Re: Culture more than tool
by
Jonathan Allen
www.ittreats.com/microsoft/aspnet/ef-code-first...
Re: Culture more than tool
by
Francois Ward