Comments (15)
Hi guys, I'll double check how rails 4 handle those headers and eventually I'll disable the check for rails version >=4
from dawnscanner.
Same problem here, and same question.
from dawnscanner.
thx :)
On Thu, Mar 6, 2014 at 1:41 PM, Paolo Perego [email protected]:
Hi guys, I'll double check how rails 4 handle those headers and eventually
I'll disable the check for rails version >=4Reply to this email directly or view it on GitHubhttps://github.com//issues/38#issuecomment-36884018
.
from dawnscanner.
Still here in latest update :)
from dawnscanner.
Because I didn't disable check family for rails 4.x automagically yet.
In next version, 1.1.0 you can disable the family with --disable-owasp-ror-cheatsheet
from dawnscanner.
It's not the whole family that should be ignored, right? Just this one check in particular?
from dawnscanner.
With --disable-owasp-ror-cheatsheet you disable (or you should :-)) all
Owasp RoR Cheatsheet checks. So the whole family
On 4 April 2014 14:30, Justin Coyne [email protected] wrote:
It's not the whole family that should be ignored, right? Just this one
check in particular?Reply to this email directly or view it on GitHubhttps://github.com//issues/38#issuecomment-39559513
.
$ cd /pub
$ more beer
The Application Security blog you really want to read:
http://armoredcode.com
from dawnscanner.
If you disable all you miss certain other ones. For example a Rails 4 app I am working on fails 2 checks (only one of which is Owasp Ror CheatSheet: Security Related Headers check failed) but if I use --disable-owasp-ror-cheatsheet
then it fails none.
from dawnscanner.
Very strange @shaneog... I turn this from "question" to "bug" so and I'll investigate furher. Can you provide me a skeleton of this app (just the gems) in order to replicate?
from dawnscanner.
Sure, I'll create a sample app with the same gems very shortly and post a link here.
from dawnscanner.
I used a previous Rails 4 sample app. Same problem.
https://github.com/shaneog/c3-puma-test
Output below:
$ dawn .
14:06:03 [*] dawn v1.1.0 is starting up
14:06:04 [$] dawn: scanning .
14:06:04 [$] dawn: rails v4.0.4 detected
14:06:04 [$] dawn: applying all security checks
14:06:04 [$] dawn: 171 security checks applied - 0 security checks skipped
14:06:04 [$] dawn: 2 vulnerabilities found
14:06:04 [!] dawn: Owasp Ror CheatSheet: Session management check failed
14:06:04 [$] dawn: Severity: info
14:06:04 [$] dawn: Priority: unknown
14:06:04 [$] dawn: Description: By default, Ruby on Rails uses a Cookie based session store. What that means is that unless you change something, the session will not expire on the server. That means that some default applications may be vulnerable to replay attacks. It also means that sensitive information should never be put in the session.
14:06:04 [$] dawn: Solution: Use ActiveRecord or the ORM you love most to handle your code session_store. Add "Application.config.session_store :active_record_store" to your session_store.rb file.
14:06:04 [$] dawn: Evidence:
14:06:04 [$] dawn: In your session_store.rb file you are not using ActiveRercord to store session data. This will let rails to use a cookie based session and it can expose your web application to a session replay attack.
14:06:04 [$] dawn: {:filename=>"./config/initializers/session_store.rb", :matches=>[]}
14:06:04 [!] dawn: Owasp Ror CheatSheet: Security Related Headers check failed
14:06:04 [$] dawn: Severity: info
14:06:04 [$] dawn: Priority: unknown
14:06:04 [$] dawn: Description: To set a header value, simply access the response.headers object as a hash inside your controller (often in a before/after_filter). Rails 4 provides the "default_headers" functionality that will automatically apply the values supplied. This works for most headers in almost all cases.
14:06:04 [$] dawn: Solution: Use response headers like X-Frame-Options, X-Content-Type-Options, X-XSS-Protection in your project.
14:06:04 [$] dawn: Evidence:
14:06:04 [$] dawn: {:filename=>"./app/controllers/application_controller.rb", :matches=>[]}
14:06:04 [*] dawn is leaving
$ dawn . --disable-owasp-ror-cheatsheet
14:06:09 [*] dawn v1.1.0 is starting up
14:06:09 [$] dawn: scanning .
14:06:09 [$] dawn: rails v4.0.4 detected
14:06:09 [$] dawn: applying all security checks
14:06:09 [$] dawn: 164 security checks applied - 0 security checks skipped
14:06:09 [*] dawn: no vulnerabilities found.
14:06:09 [*] dawn is leaving
from dawnscanner.
These are default headers in Rails 4 - how has this not been fixed in two years? I would prefer not to have to disable all of the ror cheatsheet checks just because of this one warning. Any suggestions?
from dawnscanner.
@jprince with OSS projects you don't get to demand that other people do work for free. If you want it, why don't you submit a pull request, or fund a developer to do it?
from dawnscanner.
Hi @jprince this is not fixed in 2 years because from a security perspective, those are not a priority. I receive very few pull requests, so I have to dedicate myself to high priority issues that, at this stage, are adding CVE to the library.
Please note that the cheatsheet is pretty unmaintained too.
from dawnscanner.
@thesp0nge understandable. I was thinking about opening a PR over the weekend that would ignore a particular check if the user's MVC version is above the version in which the vulnerability was addressed. So essentially something where the check's initialization function would have an additional attribute:
...
:applies=>["rails"],
:fix_version=>'4.0',
...
Then the applies_to?
function could be modified to take the MVC version in addition to the name, and only run checks that are not know to be fixed in the user's installed version. Let me know if you think that'd be worthwhile.
from dawnscanner.
Related Issues (20)
- Rewrite CVE_2011_0995
- Rewrite CVE_2013_0256
- Rewrite CVE_2013_6461
- Rewrite cve_2015_1840
- Fix hardcoded knowledge base path HOT 1
- ptools 1.3.6 check_bom: undefined method HOT 3
- Cannot run dawnscanner against the src code of a ruby applcation HOT 2
- `--json` outputs invalid JSON
- Issue with Ruby 3.0.0
- Uninitialized constant FileUtils HOT 1
- File.exists is removed from ruby 3.2 (was deprecated in 2.7). HOT 1
- kb.yaml signature mismatch for thesp0nge/dawnscanner_knowledge_base 1.0.0 HOT 2
- Parsing support with 'parser' gem
- Make KB path configurable
- Redesign knowledge base upgrade procedure
- Integrate CVSS gem as internal code
- Removing dawnscanner Rake tasks
- guess_mvc': can't read pyth-agent-1.4.0/Gemfile.lock (ArgumentError)
- Hackweek 2023: parse a simple sinatra application
- Hackweek 2023: allow a single file to be a good target
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from dawnscanner.