dawnscanner 1.2.99

data/lib/codesake/dawn/gemfile_lock.rb

@@ -0,0 +1,12 @@
+module Codesake
+  module Dawn
+    class GemfileLock
+      include Codesake::Dawn::Engine
+
+      def initialize(dir = "./", filename = "", guessed_mvc)
+        super(dir, "Gemfile.lock", {:gemfile_name=>filename, :guessed_mvc=>guessed_mvc})
+      end
+
+    end
+  end
+end

data/lib/codesake/dawn/kb/basic_check.rb

@@ -0,0 +1,228 @@
+require 'cvss'
+
+module Codesake
+  module Dawn
+    module Kb
+      module BasicCheck
+
+        include Codesake::Dawn::Utils
+
+        attr_reader :name
+        attr_reader :cve
+        attr_reader :osvdb
+        attr_reader :cvss
+        attr_reader :cwe
+        attr_reader :owasp
+        attr_reader :release_date
+        attr_reader :applies
+        attr_reader :kind
+        attr_reader :message
+        attr_reader :remediation
+        attr_reader :aux_links
+        attr_reader :mitigated
+
+        # This is the ruby version used by the target application. set in
+        # Engine class around line #107
+        attr_accessor :ruby_version
+
+        # This is an array of ruby versions that lead a parcitular version to
+        # be exploitable.
+        # In example, consider CVE-2013-1655, the Puppet rubygem version
+        # vulnerability can be exploited only if ruby version is 1.9.3 or
+        # higher
+        attr_reader :ruby_vulnerable_versions
+
+        # The framework target version
+        attr_reader   :target_version
+        # The versions of the framework that fixes the vulnerability
+        attr_reader   :fixes_version
+
+        # Vulnerability evidences
+        attr_reader   :evidences
+
+        # Check status. Returns the latest vuln? call result
+        attr_reader   :status
+
+        # Put the check in debug mode
+        attr_accessor :debug
+
+        # This is a flag for the security check family. Valid values are:
+        #   + generic_check
+        #   + code_quality
+        #   + cve_bulletin
+        #   + code_style
+        #   + owasp_ror_cheatsheet
+        #   + owasp_top_10_n (where n is a number between 1 and 10)
+        attr_accessor :check_family
+        ALLOWED_FAMILIES = [:generic_check, :code_quality, :cve_bulletin, :code_style, :owasp_ror_cheatsheet, :owasp_top_10_1, :owasp_top_10_2, :owasp_top_10_3, :owasp_top_10_4, :owasp_top_10_5, :owasp_top_10_6, :owasp_top_10_7, :owasp_top_10_8, :owasp_top_10_9, :owasp_top_10_10]
+
+        # This is the check severity level. It tells how dangerous is the
+        # vulnerability for you application.
+        #
+        # Valid values are:
+        #   + :critical
+        #   + :high
+        #   + :medium
+        #   + :low
+        #   + :info
+        #   + :none
+        attr_accessor :severity
+
+        # This is the check priority level. It tells how fast you should
+        # mitigate the vulnerability.
+        #
+        # Valid values are:
+        #   + :critical
+        #   + :high
+        #   + :medium
+        #   + :low
+        #   + :info
+        #   + :none
+        attr_accessor :priority
+
+        def initialize(options={})
+          @applies                  = []
+          @ruby_version             = ""
+          @ruby_vulnerable_versions = []
+
+          @name         = options[:name]
+          @cvss         = options[:cvss]
+          @cwe          = options[:cwe]
+          @cve          = options[:cve]
+          @osvdb        = options[:osvdb]
+          @owasp        = options[:owasp]
+          @release_date = options[:release_date]
+          @applies      = options[:applies] unless options[:applies].nil?
+          @kind         = options[:kind]
+          @message      = options[:message]
+          @remediation  = options[:mitigation]
+          @aux_links    = options[:aux_links]
+
+          @target_version = options[:target_version]
+          @fixes_version  = options[:fixes_version]
+          @ruby_version   = options[:ruby_version]
+
+          @evidences    = []
+          @evidences    = options[:evidences] unless options[:evidences].nil?
+          @mitigated    = false
+          @status       = false
+          @debug        = false
+          @severity     = :none
+          @priority     = :none
+          @check_family = :generic_check
+
+          @severity         = options[:severity] unless options[:severity].nil?
+          @priority         = options[:priority] unless options[:priority].nil?
+          @check_family     = options[:check_family] unless options[:check_family].nil?
+
+          # FIXME.20140325
+          #
+          # I don't want to manually fix 150+ ruby files to add something I can
+          # deal here
+          @check_family = :cve if !options[:name].nil? && options[:name].start_with?('CVE-')
+
+          if $logger.nil?
+            require 'codesake-commons'
+            $logger  = Codesake::Commons::Logging.instance
+            $logger.helo "dawn-basic-check", Codesake::Dawn::VERSION
+          end
+        end
+
+        def self.families
+          return ALLOWED_FAMILIES.map { |x| x.to_s }
+        end
+
+        def family=(item)
+          if ! ALLOWED_FAMILIES.find_index(item.to_sym).nil?
+            instance_variable_set(:@check_family, item.to_sym)
+            return item
+          else
+            $logger.err("invalid check family: #{item}")
+            instance_variable_set(:@check_family, :generic_check)
+            return @family
+          end
+        end
+
+        def family
+          return "CVE bulletin"                   if @check_family == :cve
+          return "Ruby coding style"              if @check_family == :code_style
+          return "Ruby code quality check"        if @check_family == :code_quality
+          return "Owasp Ruby on Rails cheatsheet" if @check_family == :owasp_ror_cheatsheet
+          return "Owasp Top 10"                   if @check_family.to_s.start_with?('owasp_top_10')
+          return "Unknown"
+        end
+
+        def priority
+          return (@priority == :none)? "unknown" : @priority.to_s
+        end
+        def severity
+          return @severity.to_s unless @severity == :none
+
+          # if not set and if cvss is available, than use CVSS
+          unless self.cvss.nil?
+
+            score = Cvss::Engine.new.score(self.cvss)
+            case score
+            when 10
+              return "critical"
+            when 7..9
+              return "high"
+            when 4..6
+              return "medium"
+            when 2..3
+              return "low"
+            when 0..1
+              return "info"
+            else 
+              return "unknown"
+            end
+          else
+            return "unknown"
+          end
+
+          # if not set, no cvss available just return unknown
+          return "unknown"
+        end
+
+        def applies_to?(name)
+          ! @applies.find_index(name).nil?
+        end
+        def cve_link
+          "http://cve.mitre.org/cgi-bin/cvename.cgi?name=#{@name}"
+        end
+        def nvd_link
+          "http://web.nvd.nist.gov/view/vuln/detail?vulnId=#{@name}"
+        end
+        def rubysec_advisories_link
+          "http://www.rubysec.com/advisories/#{@name}/"
+        end
+        def osvdb_link
+          "http://osvdb.org/show/osvdb/#{@osvdb}"
+        end
+
+        def cvss_score
+          return Cvss::Engine.new.score(self.cvss) unless self.cvss.nil?
+          "    "
+        end
+
+        def mitigated?
+          self.mitigated
+        end
+
+        # Performs a self check against some core values from being not nil
+        #
+        # @return an Array with attributes with a nil value
+        def lint
+          ret = []
+          ret << :cve if @cve.nil?
+          ret << :osvdb if @osvdb.nil?
+          ret << :cvss if @cvss.nil?
+          ret << :severity if @severity == :none
+          ret << :priority if @priority == :none
+
+          ret
+        end
+      end
+    end
+  end
+end

data/lib/codesake/dawn/kb/combo_check.rb

@@ -0,0 +1,64 @@
+module Codesake
+  module Dawn
+    module Kb
+      module ComboCheck
+        include BasicCheck
+
+        attr_reader   :checks
+        attr_accessor :options
+        attr_reader   :vulnerable_checks
+
+
+        def initialize(options={})
+          super(options)
+          @vuln_if_all_fails = true
+          @vuln_if_all_fails = options[:vuln_if_all_fails] unless options[:vuln_if_all_fails].nil?
+          @checks = options[:checks]
+          @vulnerable_checks = []
+          @options = options
+        end
+
+        def vuln?
+          ret = true
+          at_least_one = false
+          @checks.each do |check|
+            check_vuln = false
+            check.detected_ruby   = @options[:detected_ruby]    if check.kind == Codesake::Dawn::KnowledgeBase::RUBY_VERSION_CHECK
+            check.dependencies    = @options[:dependencies]     if check.kind == Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK
+            check.root_dir        = @options[:root_dir]         if check.kind == Codesake::Dawn::KnowledgeBase::PATTERN_MATCH_CHECK
+            check.debug           = self.debug
+
+            check_vuln = check.vuln? if check.respond_to?(:vuln?)
+
+            ret = ret && check_vuln
+            at_least_one = true if check_vuln
+            @evidences << check.evidences if check_vuln
+            @vulnerable_checks << check if check_vuln
+            raise "A check class doesn't respond to vuln? in combo (#{check.class})" unless check.respond_to?(:vuln?)
+          end
+
+          dump_status
+          debug_me("combo_check: is_vulnerable_if_all_checks_fail = #{@vuln_if_all_fails}, RET = #{ret}, at_least_one= #{at_least_one}")
+          return ret if @vuln_if_all_fails
+          return at_least_one unless @vuln_if_all_fails
+        end
+
+        def dump_status
+          @checks.each do |check|
+            debug_me("check name is #{check.name} and vulnerable status is #{check.status}")
+          end
+
+          true
+        end
+
+        def self.find_vulnerable_checks_by_class(list=[], klass=Object)
+          list.each do |l|
+            return l if l.instance_of?(klass)
+          end
+          nil
+        end
+
+      end
+    end
+  end
+end

data/lib/codesake/dawn/kb/cve_2004_0755.rb

@@ -0,0 +1,32 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-06
+			class CVE_2004_0755
+				include RubyVersionCheck
+
+				def initialize
+          message = "The FileStore capability in CGI::Session for Ruby before 1.8.1, and possibly PStore, creates files with insecure permissions, which can allow local users to steal session information and hijack sessions."
+
+          super({
+            :name=>"CVE-2004-0755",
+            :cvss=>"AV:L/AC:L/Au:N/C:P/I:N/A:N",
+            :release_date => Date.new(2004, 10, 20),
+            :cwe=>"",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
+            :message=>message,
+            :mitigation=>"Upgrade your ruby interpreter",
+            :aux_links=>["http://xforce.iss.net/xforce/xfdb/16996"]
+          })
+
+          self.safe_rubies = [{:engine=>"ruby", :version=>"1.8.999", :patchlevel=>"p0"}, {:engine=>"ruby", :version=>"1.6.999", :patchlevel=>"p0"}]
+
+
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2004_0983.rb

@@ -0,0 +1,30 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-06
+			class CVE_2004_0983
+				include RubyVersionCheck
+
+				def initialize
+          message = "The CGI module in Ruby 1.6 before 1.6.8, and 1.8 before 1.8.2, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a certain HTTP request." 
+          super({
+            :name=>"CVE-2004-0983",
+            :cvss=>"AV:N/AC:L/Au:N/C:N/I:N/A:P",
+            :release_date => Date.new(2005, 03, 01),
+            :cwe=>"",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
+            :message=>message,
+            :mitigation=>"Upgrade your ruby interpreter",
+            :aux_links=>["http://xforce.iss.net/xforce/xfdb/17985"]
+          })
+
+          self.safe_rubies = [{:engine=>"ruby", :version=>"1.8.3", :patchlevel=>"p0"}, {:engine=>"ruby", :version=>"1.6.7", :patchlevel=>"p0"}]
+
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2005_1992.rb

@@ -0,0 +1,30 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-06
+			class CVE_2005_1992
+				include RubyVersionCheck
+
+				def initialize
+          message = "The XMLRPC server in utils.rb for the ruby library (libruby) 1.8 sets an invalid default value that prevents \"security protection\" using handlers, which allows remote attackers to execute arbitrary commands."
+
+          super({
+            :name=>"CVE-2005-1992",
+            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:P",
+            :release_date => Date.new(2005, 06, 20),
+            :cwe=>"",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
+            :message=>message,
+            :mitigation=>"Upgrade your ruby interpreter",
+            :aux_links=>["http://www2.ruby-lang.org/en/20050701.html"]
+          })
+
+          self.safe_rubies = [{:engine=>"ruby", :version=>"1.8.999", :patchlevel=>"p0"}]
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2005_2337.rb

@@ -0,0 +1,32 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-06
+			class CVE_2005_2337
+				include RubyVersionCheck
+
+				def initialize
+          message="Ruby 1.6.x up to 1.6.8, 1.8.x up to 1.8.2, and 1.9.0 development up to 2005-09-01 allows attackers to bypass safe level and taint flag protections and execute disallowed code when Ruby processes a program through standard input (stdin)."
+          super({
+            :name=>"CVE-2005-2337",
+            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:P",
+            :release_date => Date.new(2005, 10, 07),
+            :cwe=>"",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
+            :message=>message,
+            :mitigation=>"Upgrade your ruby interpreter",
+            :aux_links=>["http://www.ruby-lang.org/en/20051003.html"]
+          })
+
+          self.safe_rubies = [
+            {:engine=>"ruby", :version=>"1.6.8", :patchlevel=>"p0"}, 
+            {:engine=>"ruby", :version=>"1.8.3", :patchlevel=>"p0"}, 
+          ]
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2006_1931.rb

@@ -0,0 +1,32 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-06
+			class CVE_2006_1931
+				include RubyVersionCheck
+
+				def initialize
+          message = "The HTTP/XMLRPC server in Ruby before 1.8.2 uses blocking sockets, which allows attackers to cause a denial of service (blocked connections) via a large amount of data."
+          super({
+            :name=>"CVE-2006-1931",
+            :cvss=>"AV:N/AC:L/Au:N/C:N/I:N/A:P",
+            :release_date => Date.new(2005, 06, 20),
+            :cwe=>"",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
+            :message=>message,
+            :mitigation=>"Upgrade your ruby interpreter",
+            :aux_links=>["http://www.securityfocus.com/bid/17645"]
+          })
+
+          self.safe_rubies = [
+            {:engine=>"ruby", :version=>"1.8.3", :patchlevel=>"p0"},
+            {:engine=>"ruby", :version=>"1.6.8", :patchlevel=>"p0"}
+          ]
+
+				end
+			end
+		end
+	end
+end