#Heroku ruby download code

We reported the vulnerability to the Ruby team shortly after discovery.

This is useful in cases where spaces cause issues in your payloads. Looking at the gettextfile function, we could see a call to open using what appeared to be user controlled data: 778 #Д§79 # Retrieves +remotefile+ in ASCII (text) mode, storing the result inД§81 # If +localfile+ is nil, returns retrieved data.Д§82 # If a block is supplied, it is passed the retrieved data oneД§85 def gettextfile(remotefile, localfile = File.basename(remotefile),Д§95 retrlines('RETR #, which is a special shell variable called the Internal Field Separator. It didn't take long to identify a few locations where the open function was being used to access files for reading and writing.

#Heroku ruby download code

Kernel.open('| command') and open('| command')ДЄll of the above functions are common vectors to gain Remote Code Execution (RCE) in Ruby applications, and are thus one of the first things to look for during code analysis.

While reading through the code in ftp.rb there were a few of the usual suspects to look out for: Turns out there is a solitary ftp.rb file, and it only weighed in at 1496 lines of code. We started looking into the lib/net folder, half expecting a custom C implementation of FTP. It turns out Ruby has its own FTP library and this is packaged as net/ftp. $ grep -i ftp -R *Д¬hangeLog:net/ftp: add a new option ssl_handshake_timeout to Net::FTP.new.Д¬hangeLog:net/ftp: close the socket directly when an error occurs during TLS handshake.Д¬hangeLog:Otherwise, in Net::FTP#close hungs until read_timeout exceeded.Д¬hangeLog:net/ftp: close the connection if the TLS handshake timeout is exceeded. To do our investigation we downloaded the latest source code for Ruby, at the time version 2.4.2, and did a quick grep for any mention of FTP. And second, to determine if Ruby had a custom FTP implementation, whether this also allowed FTP wildcards and, if so, if vulnerabilities also existed in this implementation. Our approach was twofold, first to determine if Ruby uses libcurl for its FTP functions, and if so, could this vulnerability be triggered in a Ruby application. On a hunch, and because a large number of our customers make use of Ruby, we decided to look at Ruby's FTP implementation. Once we were confident that all instances were flagged, we started looking into other libraries that might have a similar issue. Direct libcurl usage inside HerokuВґs systems were identified and marked for patching. As soon as the vulnerability was made public, we went through our various systems to determine how they are affected and to initiate the patching process. The FTP function contained an out of bounds read when processing wildcards. Vulnerability TriageДЄ vulnerability, CVE-2017-8817, was identified in libcurl.

The following Ruby vulnerability was identified during this process. We also spend time looking for 'adjacent' and similar bugs in other products. Part of this process involves evaluating possible attack scenarios not included in the original vulnerability report. Once a new vulnerability drops, we jump into action to triage and determine how our platform and customers may be affected.

At Heroku we consistently monitor vulnerability feeds for new issues.