How I cross-site scripted Twitter in 15 minutes, and why you shouldn't store important data on 37signals' applications
Today the Ruby on Rails security team released a patch for a cross-site scripting issue which affected multiple high-profile applications, including Twitter and Basecamp.
Context & Ripple Effects
Twitter had already been linked to a serious viral-attack vulnerability in March 2009, putting another security exposure in a familiar operational context. Its move away from Ruby toward Scala also made the framework behind this incident strategically relevant, rather than merely an implementation detail.
The Rails security team’s patch gives affected operators a defined remediation path, but the incident shows how a flaw in shared application infrastructure can reach both a social service and a business-software provider.
First-order effects
- Twitter and Basecamp must apply the Rails patch and review the affected cross-site-scripting exposure in their own deployments.
- The Ruby on Rails security team becomes the immediate source of remediation for applications whose security depends on the framework’s release cycle.
Second-order effects
- Twitter’s security response has to be weighed alongside its Ruby-to-Scala transition, making framework dependence part of both its reliability and architecture decisions.
- Other Rails application operators face pressure to assess whether the patched vulnerability reaches their deployments, rather than treating the issue as unique to Twitter or Basecamp.
Third-order effects
- If high-profile services repeatedly inherit security risk from common web frameworks, framework patch velocity and upgrade discipline become a competitive requirement for hosted application providers.
- The incident points toward application-security accountability being shared between framework maintainers and the companies that deploy their code.
The trend: Shared web frameworks are becoming a common security boundary, making upstream patching and downstream deployment practices inseparable.