heroku/heroku-cve-2013-0333
Inspect all of your heroku apps to see if they are running a vulnerable version of Rails
A serious security vulnerability has been found in the Ruby on Rails framework. This exploit affects nearly all applications running Rails versions 2.3 and 3.0, and a patch has been made available.
Rails developers can get a full list of all your affected Heroku applications by running this script. The following Rails versions have been patched and deemed safe from this exploit:
If you do not upgrade, an attacker can trivially gain access to your application, its data, and run arbitrary code or commands. Heroku recommends upgrading to a patched version immediately.
$ git clone [email protected]:heroku/heroku-CVE-2013-0333.git
$ cd heroku-CVE-2013-0333
$ ruby heroku-CVE-2013-0333.rb
The Heroku Security Team's PGP key is available at https://policy.heroku.com/security