Brakeman Report

Application Path Rails Version Brakeman Version Report Time Checks Performed
/Users/cktricky/tmp/railsgoat 3.2.11 2.6.1 2014-07-29 12:41:05 -0500

2.412842 seconds
BasicAuth, ContentTag, CrossSiteScripting, DefaultRoutes, Deserialize, DetailedExceptions, DigestDoS, EscapeFunction, Evaluation, Execute, FileAccess, FilterSkipping, ForgerySetting, HeaderDoS, I18nXSS, JRubyXML, JSONParsing, LinkTo, LinkToHref, MailTo, MassAssignment, ModelAttrAccessible, ModelAttributes, ModelSerialize, NestedAttributes, NumberToCurrency, QuoteTableName, Redirect, RegexDoS, Render, RenderDoS, ResponseSplitting, SQL, SQLCVEs, SSLVerify, SafeBufferManipulation, SanitizeMethods, SelectTag, SelectVulnerability, Send, SendFile, SessionSettings, SimpleFormat, SingleQuotes, SkipBeforeFilter, StripTags, SymbolDoS, TranslateBug, UnsafeReflection, ValidationRegex, WithoutProtection, YAMLParsing

Summary

Scanned/Reported Total
Controllers 17
Models 11
Templates 73
Errors 0
Security Warnings 27 (16)
Ignored Warnings 0

Warning Type Total
Attribute Restriction 1
Command Injection 1
Cross Site Scripting 5
Cross-Site Request Forgery 1
Denial of Service 2
File Access 1
Format Validation 1
Mass Assignment 5
Remote Code Execution 5
SQL Injection 3
Session Setting 2

Security Warnings

Confidence Class Method Warning Type Message
High BenefitFormsController download File Access
Parameter value used in file name near line 11: send_file(params[:type].constantize.new(params[:name]...
High Api::V1::MobileController show Remote Code Execution
Unsafe reflection method constantize called with parameter value near line 9: params[:class].classify...
High Api::V1::MobileController index Remote Code Execution
Unsafe reflection method constantize called with parameter value near line 16: params[:class].classif...
High BenefitFormsController download Remote Code Execution
Unsafe reflection method constantize called with parameter value near line 10: params[:type].constant...
High Session Setting
Session cookies should be set to HTTP only near line 3
High Session Setting
Session secret should not be included in version control near line 7
High UsersController update SQL Injection
Possible SQL injection near line 34: User.find(:first, :conditions => ("user_id = '#{params[:user][:u...
High SQL Injection Rails 3.2.11 contains a SQL injection vulnerability (CVE-2013-6417). Upgrade to 3.2.16
Medium Benefits Benefits.make_backup Command Injection
Possible command injection near line 15: system("cp #{(local full_file_name)} #{(local data_path)}/ba...
Medium Denial of Service Rails 3.2.11 has a denial of service vulnerability in ActiveRecord: upgrade to 3.2.13 or patch
Medium Remote Code Execution
Rails 3.2.11 with globbing routes is vulnerable to directory traversal and remote code execution. Pat...
Medium Analytics hits_by_ip SQL Injection
Possible SQL injection near line 4: select("#{(local col)}")
Medium PasswordResetsController reset_password Remote Code Execution
Marshal.load called with parameter value near line 5: Marshal.load(Base64.decode64(params[:user]))
Medium Cross Site Scripting Rails 3.2.11 has a vulnerability in number helpers (CVE-2014-0081). Upgrade to Rails version 3.2.17
Medium Denial of Service Rails 3.2.11 has a denial of service vulnerability (CVE-2013-6414). Upgrade to Rails version 3.2.16

Controller Warnings

Confidence Controller Warning Type Message
High ApplicationController Cross-Site Request Forgery 'protect_from_forgery' should be called in ApplicationController

Model Warnings

Confidence Model Warning Type Message
High Benefits Attribute Restriction Mass assignment is not restricted using attr_accessible
High User Format Validation
Insufficient validation for 'email' using /.+@.+\..+/i. Use \A and \z as anchors near line 12
High User Mass Assignment Potentially dangerous attribute available for mass assignment: :admin
Weak KeyManagement Mass Assignment Potentially dangerous attribute available for mass assignment: :user_id
Weak Message Mass Assignment Potentially dangerous attribute available for mass assignment: :creator_id
Weak Message Mass Assignment Potentially dangerous attribute available for mass assignment: :receiver_id
Weak User Mass Assignment Potentially dangerous attribute available for mass assignment: :user_id

View Warnings

Confidence Template Warning Type Message
High layouts/application (AdminController#dashboard) Cross Site Scripting
Unescaped cookie value near line 12: cookies[:font]
High pay/index (PayController#index) Cross Site Scripting
Rails 3.2.11 has a vulnerability in sanitize: upgrade to 3.2.13 or patch near line 188: sanitize(user...
High pay/index (PayController#index) Cross Site Scripting
Rails 3.2.11 has a vulnerability in sanitize: upgrade to 3.2.13 or patch near line 239: sanitize(decr...
High pay/index (PayController#index) Cross Site Scripting
Rails 3.2.11 has a vulnerability in sanitize: upgrade to 3.2.13 or patch near line 261: sanitize(upda...