[null, null, {"document_url": "http://www.voiceofgreyhat.com/2012/03/ruby-on-rails-public-key-security.html", "unformatted_src": "http://1.bp.blogspot.com/-OERyHgArICM/T1ZckDJpusI/AAAAAAAACos/ZE62R_Yp4EI/s400/+Ruby_on_Rails_Security_Vulnerability_GitHub_Hacked.jpeg", "src": "http://1.bp.blogspot.com/-OERyHgArICM/T1ZckDJpusI/AAAAAAAACos/ZE62R_Yp4EI/s400/+Ruby_on_Rails_Security_Vulnerability_GitHub_Hacked.jpeg", "formatted_filename": "Ruby on Rails Security Vulnerability GitHub Hacked", "rendered_width": 400, "rendered_height": 265}, null, {"document_url": "http://www.voiceofgreyhat.com/2012/03/ruby-on-rails-public-key-security.html", "unformatted_src": "http://3.bp.blogspot.com/-RxwiSFen_Nw/TjQLGGZwd5I/AAAAAAAAAPw/mVJsXm-Qib0/s1600/images.png", "src": "http://3.bp.blogspot.com/-RxwiSFen_Nw/TjQLGGZwd5I/AAAAAAAAAPw/mVJsXm-Qib0/s1600/images.png", "formatted_filename": "images"}, null, null, {"document_url": "http://www.voiceofgreyhat.com/2012/03/ruby-on-rails-public-key-security.html", "unformatted_src": "http://www.linkwithin.com/pixel.png", "src": "http://www.linkwithin.com/pixel.png", "formatted_filename": "pixel", "alt_text": "Related Posts Plugin for WordPress, Blogger..."}, null, null, {"document_url": "http://www.voiceofgreyhat.com/2012/03/ruby-on-rails-public-key-security.html", "unformatted_src": "https://lh6.googleusercontent.com/-j9r4g4Hdrp4/VGT-dp85TbI/AAAAAAAAJak/mW1vUIQXZCM/w674-h666-no/VOGH_Development.jpg", "src": "https://lh6.googleusercontent.com/-j9r4g4Hdrp4/VGT-dp85TbI/AAAAAAAAJak/mW1vUIQXZCM/w674-h666-no/VOGH_Development.jpg", "formatted_filename": "VOGH Development", "rendered_width": 290, "rendered_height": 400}, null, null, {"document_url": "http://www.voiceofgreyhat.com/2012/03/ruby-on-rails-public-key-security.html", "unformatted_src": "http://smallbusinessindia.intuit.in/wp-content/themes/default/images/twitter.png", "src": "http://smallbusinessindia.intuit.in/wp-content/themes/default/images/twitter.png", "formatted_filename": "twitter", "alt_text": "follow us on twitter!"}, null, null, null, null, {"document_url": "http://www.voiceofgreyhat.com/2012/03/ruby-on-rails-public-key-security.html", "unformatted_src": "http://i44.tinypic.com/a3f5h0.jpg", "src": "http://i44.tinypic.com/a3f5h0.jpg", "formatted_filename": "a f h", "rendered_width": 290, "rendered_height": 350}, null, null, null, null, null]
Ruby on Rails Public Key Security Vulnerability In GitHub

Posted by Avik Sarkar On 3/07/2012 03:11:00 pm A Russian security researcher named Homakov has found that Github has succumbed to a public key vulnerability in Ruby on Rails which is allowing a normal user to gain administrator access into the popular Rails Git. Homakov exploited a flaw in how the Ruby on Rails web framework handles mass assignments that allowed him to write a posting, delete a posting or push changes into source code on any GitHub project. Homakov had previously created an issue regarding mass assignment security on the rails issue tracker on GitHub; this was closed by the developers saying that it was the application developers' responsibility to secure their applications. Homakov then decided to demonstrate the issue using the nearest Ruby on Rails application, GitHub. The problem or in other word this security flaws is known as the mass assignment vulnerability, has been around since the ability to set a number of attributes in one call was introduced in Rails. Later GitHub confirms to close that security hole.
According to the GitHub official Blog post:-
"The root cause of the vulnerability was a failure to properly check incoming form parameters, a problem known as the mass-assignment vulnerability. In parallel to the attack investigation we initiated a full audit of the GitHub codebase to ensure that no other instances of this vulnerability were present. This audit is still ongoing, and I am going to personally ensure that we have a strategy going forward to prevent this type of vulnerability from happening again.
I sincerely apologize for allowing this to happen. Security is our priority and I will be arranging additional external security audits above and beyond our normal schedule to further test our security measures and give you peace of mind."
Brief About GitHub:-
Github is the web based front-end set up around Linus Torvald's Git revision control system. Due to the web site's extensive social networking features combined with the Git revisioning system Github has become extremely popular. Github is also used by a number of high-profile projects including the Linux kernel. 

Categories: NEWS , security-news , vulnerablity