heroku-CVE-2013-0269.rb

## The quick-and-nasty CVE-2013-0269 Heroku inspector!
## Originally brought to you by @elliottkember with changes by @markpundsack and @hone @ Heroku
## Download and run using:
## ruby heroku-CVE-2013-0269.rb

require 'rubygems'

json15_max = Gem::Version.new("1.5.4")
json15_min = Gem::Version.new("1.5.0")
json16_max = Gem::Version.new("1.6.7")
json16_min = Gem::Version.new("1.6.0")
json17_max = Gem::Version.new("1.7.6")
json17_min = Gem::Version.new("1.7.0")

puts "JSON Versions Affected: <= #{json15_max}, > #{json16_min}, <= #{json16_max}, #{json17_min} <= #{json17_max}"
 
`heroku apps`.split("\n").each do |app|
  app = app.strip
  
  # Some "heroku apps" lines have === formatting for grouping. They're not apps.
  next if app[0..2] == "==="
  
  # Some are appended by owner emails
  app = app.split(" ")[0].to_s.strip
  
  # Blank lines can be ommitted.
  next if app == ""

  json_version_number = `heroku run \"ruby -e \\"begin;File.stat 'Gemfile.lock';rescue;exit;end;require 'bundler/setup';require 'json';puts JSON::VERSION\\"\" -a #{app}`
  next if json_version_number.include?("json (LoadError)")
  json_version_number = json_version_number.split("\n")[-1]
  begin
    json_version        = Gem::Version.new(json_version_number)
    if json_version_number &&
        (json_version <= json15_max ||
         json_version >= json16_min && json_version <= json16_max ||
         json_version >= json17_min && json_version <= json17_max)
      puts "Uh oh! #{app} has JSON #{json_version_number}."
    else
      puts "..."
    end
  rescue ArgumentError => e
    puts "..."
  end
end