diff --git a/app/controllers/tutorials_controller.rb b/app/controllers/tutorials_controller.rb index 1e1d1dd..7bc3459 100755 --- a/app/controllers/tutorials_controller.rb +++ b/app/controllers/tutorials_controller.rb @@ -56,4 +56,50 @@ class TutorialsController < ApplicationController def guard end + def info_disclosure + @bad_code_1 = + %q{ + + + + + + + + + + + + + + + + + + + + + + + +
Full NameIncomeBonusesYears w/ MetaCorpSSNDoB
<%= "#{@user.first_name} #{@user.last_name}" %><%= @user.work_info.income %><%= @user.work_info.bonuses %><%= @user.work_info.years_worked %><%= @user.work_info.SSN %><%= @user.work_info.DoB %>
+ } + + @good_code_1 = %q{ + class WorkInfo < ActiveRecord::Base + attr_accessible :DoB, :SSN, :bonuses, :income, :years_worked + belongs_to :user + + # We should probably use this + def last_four + "***-**-" << self.SSN[-4,4] + end + + end + } + + @bad_code_2 = %q{<%= @user.work_info.SSN %>} + @good_code_2 = %q{<%= @user.work_info.last_four %>} + end + end diff --git a/app/views/layouts/tutorial/_sidebar.html.erb b/app/views/layouts/tutorial/_sidebar.html.erb index 1fc24ee..7aa9ae8 100755 --- a/app/views/layouts/tutorial/_sidebar.html.erb +++ b/app/views/layouts/tutorial/_sidebar.html.erb @@ -99,8 +99,11 @@
  • <%= link_to "Guard", guard_tutorials_path %>
    • -
  • +
  • Session Secret +
    • +
  • + <%= link_to "Info Dislosure", info_disclosure_tutorials_path %>
  • DB Sessions diff --git a/app/views/layouts/tutorial/info_disclosure/_ssn_disclosure.html.erb b/app/views/layouts/tutorial/info_disclosure/_ssn_disclosure.html.erb new file mode 100644 index 0000000..76c7d12 --- /dev/null +++ b/app/views/layouts/tutorial/info_disclosure/_ssn_disclosure.html.erb @@ -0,0 +1,98 @@ +
    +
    +
    + Information Disclosure (Sensitive) +
    +
    +
    +
    +
    +
    + + + + Description + +
    +
    +
    +

    + The application stores and returns full social security numbers. The clear-text storage of this value within the database falls under <%= link_to "Insecure Cryptographic Storage", crypto_tutorials_path, {:style => "color: rgb(181, 121, 158)"}%>. However, the other failure here is that the application returns this full SSN value within the response for the user's Work Info page. Although a portion of the SSN value is obfuscated using JavaScript (when rendered in the browser), any attacker who has positioned themselves to sniff this traffic or read the user's browser cache can extract the full value from the source. +

    +
    +
    +
    +
    +
    + + + + Bug + +
    +
    +
    +

    + The bug is introduced within app/views/work_info/index.html.erb, seen on line 20: +

    +

    + 

    +						<%= @bad_code_1 %>
+
    + + The value, stored unencrypted, is called directly from the database. (line 20) +

    +
    +
    +
    +
    +
    + + + + Solution + +
    +
    +
    +

    + A model method to return only the last four digits already exists. The following code was taken from the WorkInfo model - app/models/work_info.rb: +

    +

    + 

    +					<%= @good_code_1%>
+
    +

    +

    + Essentially, this takes the SSN string from the DB, retrieves only the last four characters in the string, and concatenates the last four characters with asterisks. Because this occurs at the model level, the view page never calls the full SSN value and therefore the user's browser never receives the full SSN. The view code would need to change from... + 

    +					<%= @bad_code_2 %>
+
    + to... + 
    +					<%= @good_code_2 %>
+
    +

    + +
    +
    +
    +
    +
    + + + + Hint + +
    +
    +
    +

    + Inspect your work information closely +

    +
    +
    +
    +
    +
    +
    \ No newline at end of file diff --git a/app/views/tutorials/info_disclosure.html.erb b/app/views/tutorials/info_disclosure.html.erb new file mode 100644 index 0000000..660fb97 --- /dev/null +++ b/app/views/tutorials/info_disclosure.html.erb @@ -0,0 +1,17 @@ +
    +
    +
    +
    + <%= render :partial => "layouts/tutorial/info_disclosure/ssn_disclosure"%> +
    +
    +
    +
    + + \ No newline at end of file diff --git a/config/routes.rb b/config/routes.rb index ac5950d..6a8217d 100755 --- a/config/routes.rb +++ b/config/routes.rb @@ -39,6 +39,7 @@ resources :tutorials do get "ssl_tls" get "redirects" get "guard" + get "info_disclosure" end end