Hackers exploit Ruby on Rails vulnerability to compromise servers, create botnet

Hackers are actively exploiting a critical vulnerability in the Ruby on Rails Web application development framework in order to compromise Web servers and create a botnet.

The Ruby on Rails development team released a security patch for the vulnerability, which is known as CVE-2013-0156, back in January. However, some server administrators haven’t yet updated their Rails installations.

[ Also on InfoWorld: Ruby on Rails receives its third security patch in less than a month. | Learn how to secure your systems with the Web Browser Deep Dive PDF special report and Security Central newsletter, both from InfoWorld. ]

Ruby on Rails is a popular framework for developing Web applications based on the Ruby programming language and is used by websites including Hulu, GroupOn, GitHub and Scribd.

“It’s pretty surprising that it’s taken this long [for an exploit] to surface in the wild, but less surprising that people are still running vulnerable installations of Rails,” said Jeff Jarmoc, a security consultant with security research firm Matasano Security, Tuesday in a blog post.

The exploit that’s currently being used by attackers adds a custom cron job — a scheduled task on Linux machines — that executes a sequence of commands.

Those commands download a malicious C source file from a remote server, compile it locally and execute it. The resulting malware is a bot that connects to an IRC (Internet Relay Chat) server and joins a predefined channel where it waits for commands from the attackers.

A precompiled version of the malware is also downloaded in case the compilation procedure fails on the compromised systems.

“Functionality is limited, but includes the ability to download and execute files as commanded, as well as changing servers,” Jarmoc said. “There’s no authentication performed, so an enterprising individual could hijack these bots fairly easily by joining the IRC server and issuing the appropriate commands.”

Reports of malicious activity using this exploit were posted in recent days on several discussion boards and it also appears that some Web hosting providers were affected, Jarmoc said.

Users should update the Ruby on Rails installations on their servers to at least versions 3.2.11, 3.1.10, 3.0.19 or 2.3.15 which contain the patch for this vulnerability. However, the best course of action is probably to update to the latest available Rails versions, depending on the branch used, since other critical vulnerabilities have been addressed since then.

Attackers are increasingly compromising Web servers to use them as part of botnets. For example, many Apache servers have recently been infected with a piece of malware called Linux/Cdorked and versions of this malware were also developed for Lighttpd and Nginx Web servers.