From fe9d8b266fc414b2aa265079c821b84d3634635c Mon Sep 17 00:00:00 2001 From: Mike McCabe Date: Tue, 12 Nov 2013 18:53:28 -0500 Subject: [PATCH 1/4] adding security misconfig text --- .../misconfig/_misconfig_first.html.erb | 23 +++++- .../misconfig/_misconfig_second.html.erb | 80 +++++++++++++++++++ app/views/tutorials/misconfig.html.erb | 5 ++ config/application.rb | 2 +- config/initializers/html_entities.rb | 1 + 5 files changed, 106 insertions(+), 5 deletions(-) create mode 100644 app/views/layouts/tutorial/misconfig/_misconfig_second.html.erb create mode 100644 config/initializers/html_entities.rb diff --git a/app/views/layouts/tutorial/misconfig/_misconfig_first.html.erb b/app/views/layouts/tutorial/misconfig/_misconfig_first.html.erb index 4c2bdc6..076fab2 100755 --- a/app/views/layouts/tutorial/misconfig/_misconfig_first.html.erb +++ b/app/views/layouts/tutorial/misconfig/_misconfig_first.html.erb @@ -16,7 +16,7 @@
- Under progress... + Security misconfiguration can happen at any level of an application stack, including the platform, web server, application server, database, framework, and custom code. Developers and system administrators need to work together to ensure that the entire stack is configured properly. Automated scanners are useful for detecting missing patches, misconfigurations, use of default accounts, unnecessary services, etc.
@@ -30,7 +30,15 @@
- Under progress... +

Rails has quite a few security related configurations. One of which relates to enforcing mass assignment protection.

+

+ 

+            <%= %q{
+              config.active_record.whitelist_attributes=false
+            } %>
+
+

+

This configuration forces an application developer to whitelist attributes that can be modified with mass-assignment. When this configuration is set to false any attribute can be mass-assigned.

@@ -44,7 +52,14 @@
- Under progress... + The solution for this issue is quite simple. In your application.rb file set the configuration as follows. + 
+            <%= %q{
+              config.active_record.whitelist_attributes=true
+            } %>
+
+ Once this configuration is updated to true and the application is restarted, any attributes to be mass-assigned will have to be defined as attr_accessible. +

@@ -58,7 +73,7 @@
- Under progress... + It has to do with mass-assignment, whitelisting and configuration.
diff --git a/app/views/layouts/tutorial/misconfig/_misconfig_second.html.erb b/app/views/layouts/tutorial/misconfig/_misconfig_second.html.erb new file mode 100644 index 0000000..db874d7 --- /dev/null +++ b/app/views/layouts/tutorial/misconfig/_misconfig_second.html.erb @@ -0,0 +1,80 @@ +
+
+
+ A6 - Security Misconfiguration +
+
+
+
+
+
+ + + + Description + +
+
+
+ Another one of the Rails security configurations relates to escaping HTML entities in JSON. +
+
+
+
+
+ + + + Bug + +
+
+
+

When the following setting is set to false, HTML entities in JSON response will not be encoded.

+

+ 

+            <%= %q{
+              ActiveSupport::escape_html_entities_in_json = false
+            } %>
+
+

+
+
+
+
+
+ + + + Solution + +
+
+
+

Edit the html_entities file at config/initializers/html_entities.rb and set the following to true.

+ 

+            <%= %q{
+              ActiveSupport::escape_html_entities_in_json = true
+            } %>
+

+

Once the initializer is edited and the application is restarted, any HTML entities in JSON responses will be encoded.

+
+
+
+
+
+ + + + Hint + +
+
+
+ Think HTML entities, escaping and initializers. +
+
+
+
+
+
\ No newline at end of file diff --git a/app/views/tutorials/misconfig.html.erb b/app/views/tutorials/misconfig.html.erb index da9c0fc..e7cf527 100755 --- a/app/views/tutorials/misconfig.html.erb +++ b/app/views/tutorials/misconfig.html.erb @@ -5,6 +5,11 @@ <%= render :partial => "layouts/tutorial/misconfig/misconfig_first"%> +
+
+ <%= render :partial => "layouts/tutorial/misconfig/misconfig_second"%> +
+
diff --git a/config/application.rb b/config/application.rb index 1d45be7..700c154 100755 --- a/config/application.rb +++ b/config/application.rb @@ -40,7 +40,7 @@ module Railsgoat config.filter_parameters += [:password] # Enable escaping HTML in JSON. - config.active_support.escape_html_entities_in_json = false + #config.active_support.escape_html_entities_in_json = false # Use SQL instead of Active Record's schema dumper when creating the database. # This is necessary if your schema can't be completely dumped by the schema dumper, diff --git a/config/initializers/html_entities.rb b/config/initializers/html_entities.rb new file mode 100644 index 0000000..a4df94a --- /dev/null +++ b/config/initializers/html_entities.rb @@ -0,0 +1 @@ +ActiveSupport::escape_html_entities_in_json = false From e077ad68156297fe756cbbbbe39baea8d8ca2581 Mon Sep 17 00:00:00 2001 From: Mike McCabe Date: Tue, 12 Nov 2013 19:20:42 -0500 Subject: [PATCH 2/4] fixing escaping entities --- config/initializers/html_entities.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/initializers/html_entities.rb b/config/initializers/html_entities.rb index a4df94a..4db1c30 100644 --- a/config/initializers/html_entities.rb +++ b/config/initializers/html_entities.rb @@ -1 +1 @@ -ActiveSupport::escape_html_entities_in_json = false +ActiveSupport::JSON::Encoding::escape_html_entities_in_json = false From 52f1ac3c78e60ca13e98ce34376abde52efe340c Mon Sep 17 00:00:00 2001 From: Mike McCabe Date: Wed, 13 Nov 2013 11:46:42 -0500 Subject: [PATCH 3/4] bringing the rails and rack version down for A9 --- Gemfile | 4 +- Gemfile.lock | 122 +++++++++++++++++++++++++++------------------------ 2 files changed, 67 insertions(+), 59 deletions(-) diff --git a/Gemfile b/Gemfile index 131581f..219755b 100755 --- a/Gemfile +++ b/Gemfile @@ -1,6 +1,8 @@ source 'https://rubygems.org' -gem 'rails', '3.2.15' +#don't upgrade +gem 'rails', '3.2.11' +gem 'rack', '1.4.3' # Bundle edge Rails instead: # gem 'rails', :git => 'git://github.com/rails/rails.git' diff --git a/Gemfile.lock b/Gemfile.lock index aed7bd1..4c937ea 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -1,32 +1,32 @@ GEM remote: https://rubygems.org/ specs: - actionmailer (3.2.15) - actionpack (= 3.2.15) - mail (~> 2.5.4) - actionpack (3.2.15) - activemodel (= 3.2.15) - activesupport (= 3.2.15) + actionmailer (3.2.11) + actionpack (= 3.2.11) + mail (~> 2.4.4) + actionpack (3.2.11) + activemodel (= 3.2.11) + activesupport (= 3.2.11) builder (~> 3.0.0) erubis (~> 2.7.0) journey (~> 1.0.4) - rack (~> 1.4.5) + rack (~> 1.4.0) rack-cache (~> 1.2) rack-test (~> 0.6.1) sprockets (~> 2.2.1) - activemodel (3.2.15) - activesupport (= 3.2.15) + activemodel (3.2.11) + activesupport (= 3.2.11) builder (~> 3.0.0) - activerecord (3.2.15) - activemodel (= 3.2.15) - activesupport (= 3.2.15) + activerecord (3.2.11) + activemodel (= 3.2.11) + activesupport (= 3.2.11) arel (~> 3.0.2) tzinfo (~> 0.3.29) - activeresource (3.2.15) - activemodel (= 3.2.15) - activesupport (= 3.2.15) - activesupport (3.2.15) - i18n (~> 0.6, >= 0.6.4) + activeresource (3.2.11) + activemodel (= 3.2.11) + activesupport (= 3.2.11) + activesupport (3.2.11) + i18n (~> 0.6) multi_json (~> 1.0) addressable (2.3.5) arel (3.0.2) @@ -52,7 +52,7 @@ GEM slim (>= 1.3.6, < 3.0) terminal-table (~> 1.4) builder (3.0.4) - bundler-audit (0.2.0) + bundler-audit (0.3.0) bundler (~> 1.2) capybara (2.1.0) mime-types (>= 1.16) @@ -73,15 +73,15 @@ GEM coffee-script-source execjs coffee-script-source (1.6.3) - cucumber (1.3.8) + cucumber (1.3.9) builder (>= 2.1.2) diff-lcs (>= 1.1.3) - gherkin (~> 2.12.1) + gherkin (~> 2.12) multi_json (>= 1.7.5, < 2.0) multi_test (>= 0.0.2) database_cleaner (1.0.1) debug_inspector (0.0.2) - diff-lcs (1.2.4) + diff-lcs (1.2.5) docile (1.1.0) dotenv (0.9.0) em-websocket (0.5.0) @@ -91,10 +91,11 @@ GEM eventmachine (1.0.3) execjs (2.0.2) fastercsv (1.5.5) - ffi (1.9.0) + ffi (1.9.3) foreman (0.63.0) dotenv (>= 0.7) thor (>= 0.13.6) + formatador (0.2.4) gauntlt (1.0.6) aruba cucumber @@ -102,22 +103,25 @@ GEM trollop gherkin (2.12.2) multi_json (~> 1.3) - guard (1.4.0) - listen (>= 0.4.2) - thor (>= 0.14.6) + guard (2.2.3) + formatador (>= 0.2.4) + listen (~> 2.1) + lumberjack (~> 1.0) + pry (>= 0.9.12) + thor (>= 0.18.1) guard-brakeman (0.8.1) brakeman (>= 2.1.1) guard (>= 1.1.0) - guard-livereload (1.0.3) - em-websocket (>= 0.2.0) - guard (>= 1.1.0) - multi_json (~> 1.0) - guard-rspec (2.5.4) - guard (>= 1.1) - rspec (~> 2.11) + guard-livereload (2.0.0) + em-websocket (~> 0.5) + guard (~> 2.0) + multi_json (~> 1.8) + guard-rspec (4.0.4) + guard (>= 2.1.1) + rspec (~> 2.14) guard-shell (0.5.1) guard (>= 1.1.0) - haml (4.0.3) + haml (4.0.4) tilt hashr (0.0.22) highline (1.6.20) @@ -133,15 +137,17 @@ GEM thor (>= 0.14, < 2.0) json (1.8.1) kgio (2.8.1) - launchy (2.3.0) + launchy (2.4.0) addressable (~> 2.3) libv8 (3.16.14.3) - listen (2.1.2) + listen (2.2.0) celluloid (>= 0.15.2) rb-fsevent (>= 0.9.3) rb-inotify (>= 0.9) lockfile (2.1.0) - mail (2.5.4) + lumberjack (1.0.4) + mail (2.4.4) + i18n (>= 0.4.0) mime-types (~> 1.16) treetop (~> 1.4.8) method_source (0.8.2) @@ -157,12 +163,11 @@ GEM polyglot (0.3.3) powder (0.2.0) thor (>= 0.11.5) - pry (0.9.6) - coderay (>= 0.9.8) - method_source (>= 0.6.5) - ruby_parser (>= 2.0.5) - slop (~> 2.1.0) - rack (1.4.5) + pry (0.9.12.3) + coderay (~> 1.0) + method_source (~> 0.8) + slop (~> 3.4) + rack (1.4.3) rack-cache (1.2) rack (>= 0.4) rack-livereload (0.3.15) @@ -171,17 +176,17 @@ GEM rack rack-test (0.6.2) rack (>= 1.0) - rails (3.2.15) - actionmailer (= 3.2.15) - actionpack (= 3.2.15) - activerecord (= 3.2.15) - activeresource (= 3.2.15) - activesupport (= 3.2.15) + rails (3.2.11) + actionmailer (= 3.2.11) + actionpack (= 3.2.11) + activerecord (= 3.2.11) + activeresource (= 3.2.11) + activesupport (= 3.2.11) bundler (~> 1.0) - railties (= 3.2.15) - railties (3.2.15) - actionpack (= 3.2.15) - activesupport (= 3.2.15) + railties (= 3.2.11) + railties (3.2.11) + actionpack (= 3.2.11) + activesupport (= 3.2.11) rack-ssl (~> 1.3.2) rake (>= 0.8.7) rdoc (~> 3.4) @@ -198,8 +203,8 @@ GEM rspec-core (~> 2.14.0) rspec-expectations (~> 2.14.0) rspec-mocks (~> 2.14.0) - rspec-core (2.14.6) - rspec-expectations (2.14.3) + rspec-core (2.14.7) + rspec-expectations (2.14.4) diff-lcs (>= 1.1.3, < 2.0) rspec-mocks (2.14.4) rspec-rails (2.14.0) @@ -229,7 +234,7 @@ GEM slim (2.0.2) temple (~> 0.6.6) tilt (>= 1.3.3, < 2.1) - slop (2.1.0) + slop (3.4.6) sprockets (2.2.2) hike (~> 1.2) multi_json (~> 1.0) @@ -251,10 +256,10 @@ GEM polyglot (>= 0.3.1) trollop (2.0) tzinfo (0.3.38) - uglifier (2.3.0) + uglifier (2.3.1) execjs (>= 0.3.0) json (>= 1.8.0) - unicorn (4.6.3) + unicorn (4.7.0) kgio (~> 2.6) rack raindrops (~> 0.7) @@ -288,8 +293,9 @@ DEPENDENCIES poltergeist powder pry + rack (= 1.4.3) rack-livereload - rails (= 3.2.15) + rails (= 3.2.11) rb-fsevent rspec-rails sass-rails From f0ca17df79bce4b15917780924ceef8407300fbb Mon Sep 17 00:00:00 2001 From: Mike McCabe Date: Wed, 13 Nov 2013 11:47:29 -0500 Subject: [PATCH 4/4] updating the information for A9 fixes #27 --- app/controllers/tutorials_controller.rb | 4 +- app/views/layouts/tutorial/_sidebar.html.erb | 2 +- .../_insecure_components_first.html.erb | 81 +++++++++++ .../tutorials/insecure_components.html.erb | 17 +++ config/routes.rb | 135 +++++++++--------- 5 files changed, 170 insertions(+), 69 deletions(-) create mode 100644 app/views/layouts/tutorial/insecure_components/_insecure_components_first.html.erb create mode 100644 app/views/tutorials/insecure_components.html.erb diff --git a/app/controllers/tutorials_controller.rb b/app/controllers/tutorials_controller.rb index f88edba..fb4d61d 100755 --- a/app/controllers/tutorials_controller.rb +++ b/app/controllers/tutorials_controller.rb @@ -15,7 +15,6 @@ class TutorialsController < ApplicationController end def injection - end def xss @@ -62,6 +61,9 @@ class TutorialsController < ApplicationController def misconfig end + + def insecure_components + end def crypto end diff --git a/app/views/layouts/tutorial/_sidebar.html.erb b/app/views/layouts/tutorial/_sidebar.html.erb index 5eb1d72..0f5328e 100755 --- a/app/views/layouts/tutorial/_sidebar.html.erb +++ b/app/views/layouts/tutorial/_sidebar.html.erb @@ -74,7 +74,7 @@ <% end %>
  • - <%= link_to ssl_tls_tutorials_path do %> + <%= link_to insecure_components_tutorials_path do %>
    diff --git a/app/views/layouts/tutorial/insecure_components/_insecure_components_first.html.erb b/app/views/layouts/tutorial/insecure_components/_insecure_components_first.html.erb new file mode 100644 index 0000000..b5192d5 --- /dev/null +++ b/app/views/layouts/tutorial/insecure_components/_insecure_components_first.html.erb @@ -0,0 +1,81 @@ +
    +
    +
    + A9 - Using Components with Known Vulnerabilities +
    +
    +
    +
    +
    +
    + + + + Description + +
    +
    +
    +

    + Virtually every application has these issues because most development teams don’t focus on ensuring their components/libraries are up to date. In many cases, the developers don’t even know all the components they are using, never mind their versions. Component dependencies make things even worse. +

    +
    +
    +
    +
    +
    + + + + Bug + +
    +
    +
    +

    + Within the Gemfile the following gem versions are set. These versions of Rails and Rack are both vulnerable to multiple attacks. +

    + 
    +				<%= %q{
+          gem 'rails', '3.2.11'
+          gem 'rack', '1.4.3'
+				} %>
+
    +

    +

    +
    +
    +
    +
    +
    + + + + Solution + +
    +
    +
    +

    + To fix this issue, simply update your gems after unpinning the gem versions. You should always run the most up to date version possible and run Bundler-Audit Regularly. +

    +
    +
    +
    +
    +
    + + + + Hint + +
    +
    +
    + Remeber to keep your gems up to date! +
    +
    +
    +
    +
    +
    \ No newline at end of file diff --git a/app/views/tutorials/insecure_components.html.erb b/app/views/tutorials/insecure_components.html.erb new file mode 100644 index 0000000..271f7a9 --- /dev/null +++ b/app/views/tutorials/insecure_components.html.erb @@ -0,0 +1,17 @@ +
    +
    +
    +
    + <%= render :partial => "layouts/tutorial/insecure_components/insecure_components_first" %> +
    +
    +
    +
    + + \ No newline at end of file diff --git a/config/routes.rb b/config/routes.rb index a58b21e..6aaa2c7 100755 --- a/config/routes.rb +++ b/config/routes.rb @@ -1,84 +1,85 @@ Railsgoat::Application.routes.draw do -get "login" => "sessions#new" -get "signup" => "users#new" -get "logout" => "sessions#destroy" + get "login" => "sessions#new" + get "signup" => "users#new" + get "logout" => "sessions#destroy" -resources :sessions do + resources :sessions do -end - -resources :users do - get "account_settings" - - resources :retirement do - end - - resources :paid_time_off do - end - - resources :work_info do - end - - resources :performance do - - end - - resources :benefit_forms do - end - resources :messages do + resources :users do + get "account_settings" + + resources :retirement do + end + + resources :paid_time_off do + end + + resources :work_info do + end + + resources :performance do + + end + + resources :benefit_forms do + + end + + resources :messages do + end + end - -end -get "download" => "benefit_forms#download" -post "upload" => "benefit_forms#upload" + get "download" => "benefit_forms#download" + post "upload" => "benefit_forms#upload" -resources :tutorials do - collection do - get "credentials" - get "injection" - get "xss" - get "broken_auth" - get "insecure_dor" - get "csrf" - get "misconfig" - get "crypto" - get "url_access" - get "ssl_tls" - get "redirects" - get "guard" - get "info_disclosure" - get "mass_assignment" - get "constantize" - get "gauntlt" + resources :tutorials do + collection do + get "credentials" + get "injection" + get "xss" + get "broken_auth" + get "insecure_dor" + get "csrf" + get "misconfig" + get "crypto" + get "url_access" + get "insecure_components" + get "ssl_tls" + get "redirects" + get "guard" + get "info_disclosure" + get "mass_assignment" + get "constantize" + get "gauntlt" + end end -end -resources :schedule do - collection do - get "get_pto_schedule" + resources :schedule do + collection do + get "get_pto_schedule" + end + end - -end -resources :admin do - get "dashboard" - get "get_user" - post "delete_user" - put "update_user" - get "get_all_users" -end - -resources :dashboard do - collection do - get "home" + resources :admin do + get "dashboard" + get "get_user" + post "delete_user" + put "update_user" + get "get_all_users" + end + + resources :dashboard do + collection do + get "home" + end end -end -root :to => "sessions#new" + root :to => "sessions#new" -end +end \ No newline at end of file