dawnscanner 1.2.99

data/lib/codesake/dawn/kb/cve_2014_0130.rb

@@ -0,0 +1,28 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-05-06
+			class CVE_2014_0130
+				include DependencyCheck
+
+				def initialize
+          message = "The implicit render functionality allows controllers to render a template, even if there is no explicit action with the corresponding name.  This module does not perform adequate input sanitization which could allow an attacker to use a specially crafted request to retrieve arbitrary files from the rails application server."
+          super({
+            :name=>"CVE-2014-0130",
+            :cvss=>"AV:N/AC:M/Au:N/C:P/I:N/A:N",
+            :release_date => Date.new(2014, 5, 6),
+            :cwe=>"",
+            :owasp=>"A9",
+            :applies=>["rails"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade rails version up to version 3.2.18, 4.0.5 or 4.1.1.",
+            :aux_links=>["https://groups.google.com/forum/#!msg/rubyonrails-security/NkKc7vTW70o/NxW_PDBSG3AJ"]
+          })
+          self.safe_dependencies = [{:name=>"rails", :version=>['3.2.18', '4.0.5', '4.1.1']}]
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2014_1233.rb

@@ -0,0 +1,29 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-02-05
+			class CVE_2014_1233
+				include DependencyCheck
+
+				def initialize
+          message = "The paratrooper-pingdom gem 1.0.0 for Ruby allows local users to obtain the App-Key, username, and password values by listing the curl process."
+
+          super({
+            :name=>"CVE-2014-1233",
+            :cvss=>"AV:L/AC:L/Au:N/C:P/I:N/A:N",
+            :release_date => Date.new(2014, 01, 10),
+            :cwe=>"200",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade paratrooper-pingdom version up to version 1.0.0.",
+            :aux_links=>["http://www.vapid.dhs.org/advisories/paratrooper-api-key-pingdom.html"]
+          })
+
+          self.safe_dependencies = [{:name=>"paratrooper-pingdom", :version=>['1.0.1']}]
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2014_1234.rb

@@ -0,0 +1,28 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-02-05
+			class CVE_2014_1234
+				include DependencyCheck
+
+				def initialize
+          message = "The paratrooper-newrelic gem 1.0.1 for Ruby allows local users to obtain the X-Api-Key value by listing the curl process."
+          super({
+            :name=>"CVE-2014-1234",
+            :cvss=>"AV:L/AC:L/Au:N/C:P/I:N/A:N",
+            :release_date => Date.new(2014, 01, 10),
+            :cwe=>"200",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade paratrooper-newrelic version up to version 1.0.1.",
+            :aux_links=>["http://www.vapid.dhs.org/advisories/paratrooper-newrelic-api.html"]
+          })
+
+          self.safe_dependencies = [{:name=>"paratrooper-newrelic", :version=>['1.0.2']}]
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2014_2322.rb

@@ -0,0 +1,30 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-03-14
+			class CVE_2014_2322
+				# Include the testing skeleton for this CVE
+				include DependencyCheck
+
+				def initialize
+          message = "Arabic Prawn Gem for Ruby contains a flaw in the ib/string_utf_support.rb file. The issue is due to the program failing to sanitize user input. This may allow a remote attacker to inject arbitrary commands."
+
+           super({
+            :name=>"CVE-2014-2322",
+            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:P",
+            :release_date => Date.new(2014, 3, 10),
+            :cwe=>"",
+            :owasp=>"A9",
+            :applies=>["sinatra", "padrino", "rails"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"At March, 14 2014 a fixed Arabic-Prawn release is not available. Please sanitize your input before passing it to this gem and upgrade to higher versions as soon as possible",
+            :aux_links=>["http://packetstormsecurity.com/files/125679/Ruby-Gem-Arabic-Prawn-0.0.1-Command-Injection.html"]
+           })
+
+           self.safe_dependencies = [{:name=>"Arabic-Prawn", :version=>['0.0.2']}]
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2014_2525.rb

@@ -0,0 +1,61 @@
+module Codesake
+	module Dawn
+		module Kb
+      class CVE_2014_2525_a
+        include BasicCheck
+
+        def initialize
+          message = "When relying on system wide libyaml, this must be > 0.1.5"
+          super({
+            :name=>"CVE-2014-2525-a",
+            :kind=>Codesake::Dawn::KnowledgeBase::CUSTOM_CHECK,
+          })
+        end
+        def vuln?
+          require 'yaml'
+          lyv = Psych.libyaml_version.join(".")
+          c = Codesake::Dawn::Kb::VersionCheck.new
+          return c.is_vulnerable_version?('0.1.6', lyv)
+        end
+      end
+      class CVE_2014_2525_b
+        include DependencyCheck
+
+        def initialize
+          message = "When non relying on system wide libyaml, psych gem must be > 2.0.5"
+          super({
+            :name=>"CVE-2014-2525-b",
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+          })
+          self.safe_dependencies = [{:name=>"psych", :version=>['2.0.5']}]
+        end
+
+      end
+
+			# Automatically created with rake on 2014-03-31
+			class CVE_2014_2525
+				include ComboCheck
+
+				def initialize
+          message = ""
+
+          super({
+            :name=>"CVE-2014-2525",
+            :cvss=>"",
+            :release_date => Date.new(2014, 3, 28),
+            :cwe=>"",
+            :owasp=>"A9",
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::COMBO_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade your system libyaml or upgrade psych gem to version 2.0.5 or higher that is linked with a safe libyaml version.",
+            :aux_links=>["https://www.ruby-lang.org/en/news/2014/03/29/heap-overflow-in-yaml-uri-escape-parsing-cve-2014-2525"],
+            :severity=>:high,
+            :prority=>:high,
+            :checks=>[CVE_2014_2525_a.new, CVE_2014_2525_b.new]
+          })
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2014_2538.rb

@@ -0,0 +1,28 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-03-23
+			class CVE_2014_2538
+				include DependencyCheck
+
+				def initialize
+          message = "rack-ssl Gem for Ruby contains a flaw that allows a reflected cross-site scripting (XSS) attack. This flaw exists because the program does not validate input passed via error messages before returning it to users. This may allow a context-dependent attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server."
+           super({
+            :name=>"CVE-2014-2538",
+            :cvss=>"AV:N/AC:M/Au:N/C:N/I:P/A:N",
+            :release_date => Date.new(2014, 3, 25),
+            :cwe=>"79",
+            :owasp=>"A3",
+            :applies=>["rails"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"A new version for rack-ssl version it has been released. Pleas upgrade at least to version 1.4.0 or higher.",
+            :aux_links=>["http://seclists.org/oss-sec/2014/q1/594"]
+           })
+
+           self.safe_dependencies = [{:name=>"rack-ssl", :version=>['1.4.0']}]
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2014_3482.rb

@@ -0,0 +1,30 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-07-04
+			class CVE_2014_3482
+				include DependencyCheck
+
+				def initialize
+          message = "Ruby on Rails contains a flaw that may allow carrying out an SQL injection attack. The issue is due to the PostgreSQL adapter for Active Record not properly sanitizing user-supplied input when quoting bitstrings. This may allow a remote attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data."
+           super({
+            :name=> "CVE-2014-3482",
+            :cve=>"CVE-2014-3482",
+            :osvdb=>"108664",
+            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:P",
+            :release_date => Date.new(2014, 7, 2),
+            :cwe=>"",
+            :owasp=>"A1",
+            :applies=>["rails"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade rails version at least to 3.2.19. As a general rule, using the latest stable version is recommended.",
+            :aux_links=>["http://weblog.rubyonrails.org/2014/7/2/Rails_3_2_19_4_0_7_and_4_1_3_have_been_released/"]
+           })
+           self.safe_dependencies = [{:name=>"rails", :version=>['3.2.19']}]
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2014_3483.rb

@@ -0,0 +1,29 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-07-07
+			class CVE_2014_3483
+				include DependencyCheck
+
+				def initialize
+          message = "Ruby on Rails contains a flaw that may allow carrying out an SQL injection attack. The issue is due to the PostgreSQL adapter for Active Record not properly sanitizing user-supplied input when quoting ranges. This may allow a remote attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data."
+           super({
+            :name=>"CVE-2014-3483",
+            :cve=>"2014-3483",
+            :osvdb=>"108665",
+            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:P",
+            :release_date => Date.new(2014, 7, 2),
+            :cwe=>"",
+            :owasp=>"A1",
+            :applies=>["rails"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade rails at least to version 4.0.7 or 4.1.3. As a general rule, using the latest stable rails version is recommended.",
+            :aux_links=>["http://weblog.rubyonrails.org/2014/7/2/Rails_3_2_19_4_0_7_and_4_1_3_have_been_released/"]
+           })
+           self.safe_dependencies = [{:name=>"rails", :version=>['4.0.7', '4.1.3']}]
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/dependency_check.rb

@@ -0,0 +1,86 @@
+module Codesake
+  module Dawn
+    module Kb
+      module DependencyCheck
+        include BasicCheck
+
+        attr_accessor :dependencies
+
+        # This attribute replaces fixed_dependency in 20130521.
+        # There are cve checks like
+        # http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-0175 that
+        # addresses two different gems firing up the vulnerability. You can
+        # read this like, "if you use gem A version A1 or if you use gem B
+        # version B1 you can occur in this issue".
+        attr_accessor :safe_dependencies
+        attr_accessor :aux_mitigation_gem
+
+        attr_accessor :not_affected
+
+        # Tells a version is not vulnerable even if in the fixes array that has
+        # a minor version number higher than the current.
+        # This is useful especially for rails version where 3.0.x, 3.1.y, 3.2.z
+        # are separated branches and the patch is provided for all of those. So
+        # if version 3.1.10 is safe and you have it, you don't be prompted
+        # about 3.2.x.
+        attr_accessor :save_minor
+        attr_accessor :save_major
+
+        def initialize(options)
+          super(options)
+          @save_minor ||= options[:save_minor]
+          @save_major ||= options[:save_major]
+        end
+
+        def vuln?
+          ret         = false
+          @mitigated  = false
+          message     = ""
+
+
+          @dependencies.each do |dep|
+            # don't care about gem version when it mitigates a vulnerability... this can be risky, maybe I would reconsider in the future.
+            @mitigated = true if dep[:name] == @aux_mitigation_gem[:name] unless @aux_mitigation_gem.nil?
+
+            @safe_dependencies.each do |safe_dep|
+              if safe_dep[:name] == "rails"
+                debug_me "Forcing save_minor flag for rails gem dependency check"
+                self.save_minor = true
+              end
+
+              if dep[:name] == safe_dep[:name]
+                v = Codesake::Dawn::Kb::VersionCheck.new(
+                  {
+                    :safe=>safe_dep[:version],
+                    :detected=>dep[:version],
+                    :save_minor => self.save_minor,
+                    :save_major => self.save_major,
+                  }
+                )
+                v.debug = self.debug
+                v.excluded = self.not_affected[:version] unless self.not_affected.nil?
+
+                vuln = v.vuln?
+                if vuln && @ruby_vulnerable_versions.empty?
+                  message = "Vulnerable #{dep[:name]} gem version found: #{dep[:version]}"
+                  ret = vuln
+                end
+              end
+            end
+          end
+
+          if ret && @mitigated
+            ret = false
+            message += "Vulnerability has been mitigated by gem #{@aux_mitigation_gem[:name]}. Don't remove it from your Gemfile"
+          end
+
+          self.evidences << message unless message.empty?
+
+          @status = ret
+
+          ret
+        end
+      end
+    end
+  end
+end

data/lib/codesake/dawn/kb/deprecation_check.rb

@@ -0,0 +1,40 @@
+module Codesake
+  module Dawn
+    module Kb
+      class DeprecationCheck
+        include BasicCheck
+
+        DEPRECATION_MATRIX = [
+          # {:gem=>"rails", :versions=>['0.x', '1.x', '2.x']},
+          # {:gem=>"sinatra", :versions=>['0.x', '1.x', '2.x']},
+          # {:gem=>"padrino", :versions=>['0.x', '1.x', '2.x']},
+          {:gem=>"ruby", :versions=>['1.1.x', '1.2.x', '1.3.x', '1.4.x', '1.5.x', '1.6.x', '1.7.x', '1.8.7']},
+        ]
+
+        attr_accessor :detected
+        attr_accessor :enable_warning
+
+        def initialize(options={})
+          super(options)
+          @enable_warning ||= options[:enable_warning]
+          debug_me "DeprecationCheck initialized"
+          $logger.warn "MVC deprecation check is disable by now" unless self.enable_warning.nil?
+        end
+
+        def vuln?
+          debug_me "vuln? @detected is #{@detected}"
+          v = Codesake::Dawn::Kb::VersionCheck.new
+          v.debug = self.debug
+          v.detected = @detected[:version]
+
+          DEPRECATION_MATRIX.each do |dm|
+            v.deprecated = dm[:versions] if dm[:gem] == @detected[:gem]
+          end
+          return false if v.deprecated.nil?
+          return v.is_detected_deprecated?
+        end
+
+      end
+    end
+  end
+end

data/lib/codesake/dawn/kb/not_revised_code.rb

@@ -0,0 +1,24 @@
+module Codesake
+  module Dawn
+    module Kb
+      class NotRevisedCode
+        include PatternMatchCheck
+
+
+        def initialize
+          super({:name=>"Not revised code",
+                :cvss=>"",
+                :release_date=>nil,
+                :cwe=>"",
+                :owasp=>"",
+                :applies=>["sinatra", "rails", "padrino"],
+                :kind=>Codesake::Dawn::KnowledgeBase::PATTERN_MATCH_CHECK,
+                :message=>"Analyzing comments, it seems your code is waiting from some review from you. Please consider take action before putting it in production.\nThis check will analyze the source code looking for the following patterns: XXX, TO_CHECK, CHECKME, CHECK and FIXME",
+                :mitigation=>"Please review the file fixing the issue.",
+                :attack_pattern => ["XXX", "TO_CHECK", "CHECKME", "CHECK", "FIXME"]
+          })
+        end
+      end
+    end
+  end
+end

data/lib/codesake/dawn/kb/operating_system_check.rb

@@ -0,0 +1,98 @@
+module Codesake
+  module Dawn
+    module Kb
+      module OperatingSystemCheck
+        include BasicCheck
+
+        # safe_os is an Hash with this form {:family=>"", :vendor=>"", :version=>""}
+        #
+        # family can be one of the following:
+        #   "linux"
+        #   "windows"
+        #   "unix"
+        #   "osx"
+        #   "freebsd"
+        #   "netbsd"
+        #   "openbsd"
+        #   "unknown"
+        # vendor will be either "microsoft", "apple", unix flavour or linux distribution accordingly
+        attr_accessor :safe_os
+        attr_accessor :target_os
+
+
+        def initialize(options={})
+          super(options)
+          os_detect
+        end
+
+        def vuln?
+          
+          return false if different_family? 
+          return false if different_vendor?
+          return vulnerable_os?
+        end
+
+        def different_family?
+          ret = false
+          @safe_os.each do |sos|
+            ret = true if ! ret && sos[:family] == @target_os[:family]
+          end
+          ret
+        end
+
+        def different_vendor?
+          ret = false
+          @safe_os.each do |sos|
+            ret = true if ! ret && sos[:vendor] == @target_os[:vendor]
+          end
+          ret
+        end
+
+        def vulnerable_os?
+          ret = false
+          @safe_os.each do |sos|
+            ret = true if ! ret && sos[:version] = 'none'
+            ret = true if ! ret && is_vulnerable_version?(@target_os[:family], sos[:version])
+          end
+          ret
+        end
+
+        
+        def os_detect
+          platform = RUBY_PLATFORM
+
+          @target_os = {}
+
+          @target_os[:family] = "osx"; @target_os[:vendor]="apple" unless /darwin/.match(platform).nil?
+          @target_os[:family] = "windows"; @target_os[:vendor]="microsoft" unless /win32/.match(platform).nil?
+          @target_os[:family] = "linux" unless /linux/.match(platform).nil?
+          @target_os[:family] = "unix"; @target_os[:vendor]="freebsd" unless /freebsd/.match(platform).nil?
+          @target_os[:family] = "unix"; @target_os[:vendor]="openbsd" unless /openbsd/.match(platform).nil?
+          @target_os[:family] = "unix"; @target_os[:vendor]="netbsd" unless /netbsd/.match(platform).nil?
+
+          begin 
+            require 'sys/uname'
+            @target_os[:version]= [Sys::Uname.release]
+          rescue # otherwise use shell
+            @target_os[:version] = [`uname -r`.strip]
+          end
+
+          tmp = ""
+          if File.exist?("/etc/SuSE-release")
+            tmp = File.readlines("/etc/SuSE-release"); 
+            @target_os[:vendor]="suse" 
+          end
+
+          if File.exist?("/etc/redhat_release")
+            tmp = File.readlines("/etc/redhat_release"); 
+            @target_os[:vendor]="redhat" 
+          end
+          if File.exist?("/etc/debian_release")
+            tmp = File.readlines("/etc/debian_release");
+            @target_os[:vendor]="debian" 
+          end
+        end
+      end
+    end
+  end
+end