dawnscanner 1.6.9 → 2.0.0.rc1

data/lib/dawn/kb/osvdb_118579.rb

@@ -1,31 +0,0 @@
-module Dawn
-		module Kb
-			# Automatically created with rake on 2015-04-04
-			class OSVDB_118579
-				# Include the testing skeleton for this Security Check
-				# include PatternMatchCheck
-				include DependencyCheck
-				# include RubyVersionCheck
-
-				def initialize
-          message = "xaviershay-dm-rails Gem for Ruby contains a flaw in the execute() function in /datamapper/dm-rails/blob/master/lib/dm-rails/storage.rb. The issue is due to the function exposing sensitive information via the process table. This may allow a local attack to gain access to MySQL credential information."
-          super({
-            :name=> "OSVDB_118579",
-            :cve=>"2015-2179",
-            :osvdb=>"118579",
-            :cvss=>"",
-            :release_date => Date.new(2015, 2, 17),
-            :cwe=>"",
-            :owasp=>"A9",
-            :applies=>["rails"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"We are not currently aware of a solution for this vulnerability (4 April 2015)",
-            :aux_links=>[""]
-           })
-           self.safe_dependencies = [{:name=>"xaviershay-dm-rails", :version=>['0.8.0']}]
-
-				end
-			end
-		end
-end

data/lib/dawn/kb/osvdb_118830.rb

@@ -1,32 +0,0 @@
-module Dawn
-		module Kb
-			# Automatically created with rake on 2015-04-05
-			class OSVDB_118830
-				# Include the testing skeleton for this Security Check
-				# include PatternMatchCheck
-				include DependencyCheck
-				# include RubyVersionCheck
-
-				def initialize
-          message = "Doorkeeper Gem for Ruby contains a flaw in lib/doorkeeper/engine.rb. The issue is due to the program storing sensitive information in production logs. This may allow a local attacker to gain access to sensitive information."
-          super({
-            :name=> "OSVDB_118830",
-            :cve=>"",
-            :osvdb=>"118830",
-            :cvss=>"",
-            :release_date => Date.new(2015, 2, 10),
-            :cwe=>"",
-            :owasp=>"A6",
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade doorkeeper gem version at least to 2.1.2. As a general rule, using the latest stable version is recommended.",
-            :aux_links=>[""]
-           })
-           self.safe_dependencies = [{:name=>"doorkeeper", :version=>['2.1.2']}]
-
-
-				end
-			end
-		end
-end

data/lib/dawn/kb/osvdb_118954.rb

@@ -1,33 +0,0 @@
-module Dawn
-		module Kb
-			# Automatically created with rake on 2015-04-04
-			class OSVDB_118954
-				# Include the testing skeleton for this Security Check
-				# include PatternMatchCheck
-				include DependencyCheck
-				# include RubyVersionCheck
-
-				def initialize
-          message = "Ruby on Rails contains a flaw that is triggered when handling a to_json call to ActiveModel::Name, which can cause an infinite loop. This may allow a remote attacker to cause a denial of service."
-          super({
-            :name=> "OSVDB_118954",
-            :cve=>"",
-            :osvdb=>"118954",
-            :cvss=>"",
-            :release_date => Date.new(2015, 2, 28),
-            :cwe=>"",
-            :owasp=>"A9",
-            :applies=>["rails"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade to latest rails ruby gems",
-            :aux_links=>["https://github.com/rails/rails/pull/19055", "https://github.com/rails/rails/issues/19050"]
-           })
-          self.save_minor=true
-          self.save_major=true
-          self.safe_dependencies = [{:name=>"rails", :version=>['4.2.1.rc3']}]
-
-				end
-			end
-		end
-end

data/lib/dawn/kb/osvdb_119878.rb

@@ -1,32 +0,0 @@
-module Dawn
-		module Kb
-			# Automatically created with rake on 2015-04-04
-			class OSVDB_119878
-				# Include the testing skeleton for this Security Check
-				# include PatternMatchCheck
-				include DependencyCheck
-				# include RubyVersionCheck
-
-				def initialize
-          message="rest-client Gem for Ruby contains a flaw in abstract_response.rb related to the handling of set-cookie headers in redirection responses that allows a remote, user-assisted attacker to conduct a session fixation attack. This flaw exists because the application, when establishing a new session, does not invalidate an existing session identifier and assign a new one. With a specially crafted request fixating the session identifier, a context-dependent attacker can ensure a user authenticates with the known session identifier, allowing the session to be subsequently hijacked."
-
-          super({
-            :name=> "OSVDB_119878",
-            :cve=>"2015-1820",
-            :osvdb=>"119878",
-            :cvss=>"",
-            :release_date => Date.new(2015, 3, 24),
-            :cwe=>"",
-            :owasp=>"A9",
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade rest-client gem version to 1.8.0 or later.",
-            :aux_links=>["https://github.com/rest-client/rest-client/issues/369"]
-           })
-          self.safe_dependencies = [{:name=>"rest-client", :version=>['1.8.0', '2.0.0.rc1', '2.0.0.rc2']}]
-
-				end
-			end
-		end
-end

data/lib/dawn/kb/osvdb_119927.rb

@@ -1,33 +0,0 @@
-module Dawn
-		module Kb
-			# Automatically created with rake on 2015-03-27
-			class OSVDB_119927
-				# Include the testing skeleton for this Security Check
-				# include PatternMatchCheck
-				include DependencyCheck
-				# include RubyVersionCheck
-
-				def initialize
-          message = "http Gem for Ruby contains a flaw related to certificate validation. The issue is due to a failure to call the OpenSSL::SSL::SSLSocket#post_connection_check method, leading to hostnames not being properly verified. By spoofing the TLS/SSL server via a certificate that appears valid, an attacker with the ability to intercept network traffic (e.g. MiTM, DNS cache poisoning) can disclose and optionally manipulate transmitted data."
-
-           super({
-            :name=> "OSVDB_119927",
-            :cve=>"2015-1828",
-            :osvdb=>"119927",
-            :cvss=>"",
-            :release_date => Date.new(2015, 3, 25),
-            :cwe=>"",
-            :owasp=>"A9",
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade http gem version at least to 0.8.0. As a general rule, using the latest stable version is recommended.",
-            :aux_links=>[""]
-           })
-           self.safe_dependencies = [{:name=>"http", :version=>['0.8.0']}]
-
-
-				end
-			end
-		end
-end

data/lib/dawn/kb/osvdb_120415.rb

@@ -1,31 +0,0 @@
-module Dawn
-		module Kb
-			# Automatically created with rake on 2015-12-01
-			class OSVDB_120415
-				include DependencyCheck
-
-				def initialize
-          title = "redcarpet Gem for Ruby markdown.c parse_inline() Function XSS"
-          message = "redcarpet gem for Ruby contains a flaw that allows a cross-site scripting (XSS) attack. This flaw exists because the parse_inline() function in markdown.c does not validate input before returning it to users. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server."
-
-          super({
-            :title=>title,
-            :name=> "OSVDB_120415",
-            :cve=>"",
-            :osvdb=>"120415",
-            :cvss=>"",
-            :release_date => Date.new(2015, 4, 7),
-            :cwe=>"",
-            :owasp=>"A9",
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade redcarpet gem to version 3.2.3 or later.",
-            :aux_links=>[""]
-           })
-          self.safe_dependencies = [{:name=>"redcarpet", :version=>['3.2.3']}]
-
-				end
-			end
-		end
-end

data/lib/dawn/kb/osvdb_120857.rb

@@ -1,34 +0,0 @@
-module Dawn
-		module Kb
-			# Automatically created with rake on 2015-12-02
-			class OSVDB_120857
-				# Include the testing skeleton for this Security Check
-				# include PatternMatchCheck
-				include DependencyCheck
-				# include RubyVersionCheck
-
-				def initialize
-          title = "refile Gem for Ruby remote_image_url Attachment Remote Command Execution"
-          message = "refile Gem for Ruby contains a flaw that is triggered when input is not sanitized when handling the 'remote_image_url' field in a form, where 'image' is the name of the attachment. This may allow a remote attacker to execute arbitrary shell commands."
-
-          super({
-            :title=>title,
-            :name=> "OSVDB_120857",
-            :cve=>"",
-            :osvdb=>"120857",
-            :cvss=>"",
-            :release_date => Date.new(2015, 4, 15),
-            :cwe=>"",
-            :owasp=>"A9",
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade refile gem to version 0.5.4 or later.",
-            :aux_links=>[""]
-           })
-          self.save_minor = true
-          self.safe_dependencies=[{:name=>"refile", :version=>['0.5.4', '0.4.-1', '0.3.-1', '0.2.-1', '0.1.-1']}]
-				end
-			end
-		end
-end

data/lib/dawn/kb/osvdb_121701.rb

@@ -1,30 +0,0 @@
-module Dawn
-		module Kb
-			# Automatically created with rake on 2015-12-02
-			class OSVDB_121701
-				include DependencyCheck
-
-				def initialize
-          title = "open-uri-cached Gem for Ruby Unsafe Temporary File Creation Local Privilege Escalation"
-          message = "open-uri-cached Gem for Ruby contains a flaw that is due to the program creating temporary files in a predictable, unsafe manner when using YAML. This may allow a local attacker to gain elevated privileges."
-
-          super({
-            :title=>title,
-            :name=> "OSVDB_121701",
-            :cve=>"",
-            :osvdb=>"121701",
-            :cvss=>"",
-            :release_date => Date.new(2015, 5, 5),
-            :cwe=>"",
-            :owasp=>"A9",
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade open-uri-cached gem to version 0.0.5 or later.",
-            :aux_links=>[""]
-           })
-          self.safe_dependencies = [{:name=>"open-uri-cached", :version=>['0.0.5']}]
-				end
-			end
-		end
-end

data/lib/dawn/kb/osvdb_132234.rb

@@ -1,34 +0,0 @@
-module Dawn
-		module Kb
-			# Automatically created with rake on 2016-10-02
-			class OSVDB_132234
-				# Include the testing skeleton for this Security Check
-				# include PatternMatchCheck
-				include DependencyCheck
-				# include RubyVersionCheck
-
-				def initialize
-					title   = "rack-attack Gem for Ruby missing normalization before request path processing"
-					message = "When using rack-attack with a rails app, developers expect the request path to be normalized. In particular, trailing slashes are stripped so a request path \"/login/\" becomes \"/login\" by the time you're in ActionController. Since Rack::Attack runs before ActionDispatch, the request path is not yet normalized. This can cause throttles and blacklists to not work as expected. E.g., a throttle: throttle('logins', ...) {|req| req.path == \"/login\" } would not match a request to '/login/', though Rails would route '/login/' to the same '/login' action."
-
-          super({
-            :title=>title,
-            :name=> "OSVDB_132234",
-            :cve=>"",
-            :osvdb=>"132234",
-            :cvss=>"",
-            :release_date => Date.new(2015, 12, 15),
-            :cwe=>"",
-            :owasp=>"A9",
-            :applies=>["rails"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade rack-attack gem to version 4.3.1 or later.",
-            :aux_links=>['https://github.com/kickstarter/rack-attack/releases/tag/v4.3.1']
-           })
-          self.safe_dependencies = [{:name=>"rack-attack", :version=>['4.3.1']}]
-
-				end
-			end
-		end
-end

data/lib/dawn/kb/owasp_ror_cheatsheet.rb

@@ -1,33 +0,0 @@
-module Dawn
-  module Kb
-    class OwaspRorCheatsheet
-      include ComboCheck
-
-      def initialize
-        message = "This Cheatsheet intends to provide quick basic Ruby on Rails security tips for developers. It complements, augments or emphasizes points brought up in the rails security guide from rails core.  The Rails framework abstracts developers from quite a bit of tedious work and provides the means to accomplish complex tasks quickly and with ease. New developers, those unfamiliar with the inner-workings of Rails, likely need a basic set of guidelines to secure fundamental aspects of their application. The intended purpose of this doc is to be that guide."
-
-        super({
-          :name=>"Owasp Ror Cheatsheet", 
-          :applies=>["rails"],
-          :kind=>Dawn::KnowledgeBase::COMBO_CHECK,
-          :aux_links=>["https://www.owasp.org/index.php/Ruby_on_Rails_Cheatsheet"],
-          :message=>message,
-          :mitigation=>"Please refere to the Ruby on Rails cheatsheet available from owasp.org to mitigate this vulnerability",
-          :checks=>[
-            Dawn::Kb::OwaspRorCheatSheet::CommandInjection.new,
-            Dawn::Kb::OwaspRorCheatSheet::Csrf.new,
-            Dawn::Kb::OwaspRorCheatSheet::SessionStoredInDatabase.new,
-            Dawn::Kb::OwaspRorCheatSheet::MassAssignmentInModel.new, 
-            Dawn::Kb::OwaspRorCheatSheet::SecurityRelatedHeaders.new, 
-
-
-          ],
-          :vuln_if_all_fails => false
-        })
-
-        # @debug = true
-
-      end
-    end
-  end
-end

data/lib/dawn/kb/owasp_ror_cheatsheet/check_for_backup_files.rb

@@ -1,18 +0,0 @@
-# It will be completely rewritten in dawnscanner v2.0.0
-#
-# require 'anemone'
-# require 'httpclient'
-
-# h=HTTPClient.new()
-# Anemone.crawl(ARGV[0]) do |anemone|
-  # anemone.on_every_page do |page|
-      # response = h.get(page.url)
-      # puts "Original: #{page.url}: #{response.code}"
-      # response = h.get(page.url.to_s.split(";")[0].concat(".bak"))
-      # puts "BAK: #{page.url.to_s.split(";")[0].concat(".bak")}: #{response.code}"
-      # response = h.get(page.url.to_s.split(";")[0].concat(".old"))
-      # puts "OLD: #{page.url.to_s.split(";")[0].concat(".old")}: #{response.code}"
-      # response = h.get(page.url.to_s.split(";")[0].concat("~"))
-      # puts "~: #{page.url.to_s.split(";")[0].concat("~")}: #{response.code}"
-  # end
-# end

data/lib/dawn/kb/owasp_ror_cheatsheet/check_for_safe_redirect_and_forward.rb

@@ -1,57 +0,0 @@
-module Dawn
-  module Kb
-    module OwaspRorCheatSheet
-
-      class CheckForSafeRedirectAndForward
-        include PatternMatchCheck
-
-        def initialize
-          message = <<-EOT
-Web applications often require the ability to dynamically redirect users based
-on client-supplied data. To clarify, dynamic redirection usually entails the
-client including a URL in a parameter within a request to the application. Once
-received by the application, the user is redirected to the URL specified in the
-request.
-
-For example: http://www.example.com/redirect?url=http://www.example_commerce_site.com/checkout
-
-The above request would redirect the user to http://www.example.com/checkout.
-
-The security concern associated with this functionality is leveraging an
-organization's trusted brand to phish users and trick them into visiting a
-malicious site, in our example, "badhacker.com".
-
-Example: http://www.example.com/redirect?url=http://badhacker.com
-
-The most basic, but restrictive protection is to use the :only_path option.
-Setting this to true will essentially strip out any host information.
-          EOT
-
-          super({
-            :name=>"Owasp Ror CheatSheet: Check for safe redirect and forward",
-            :kind=>Dawn::KnowledgeBase::PATTERN_MATCH_CHECK,
-            :applies=>["rails"],
-            :glob=>"*.rb",
-            :aux_links=>["https://www.owasp.org/index.php/Ruby_on_Rails_Cheatsheet"],
-            :message=>message,
-            :attack_pattern => ["redirect_to"],
-            :mitigation=>"The most basic, but restrictive protection is to use the :only_path option. Setting this to true will essentially strip out any host information.",
-            :severity=>:info,
-            :check_family=>:owasp_ror_cheatsheet
-          })
-          # @debug = true
-
-        end
-        def vuln?
-          super
-          ret = []
-          @evidences.each do |ev|
-            ret << ev unless ev[:matches].include? ":only_path => true"
-          end
-          @evidences = ret unless ret.empty?
-          return @evidences.empty?
-        end
-      end
-    end
-  end
-end

data/lib/dawn/kb/owasp_ror_cheatsheet/command_injection.rb

@@ -1,28 +0,0 @@
-module Dawn
-  module Kb
-    module OwaspRorCheatSheet
-      class CommandInjection
-        include PatternMatchCheck
-
-        def initialize
-          message = "Ruby offers a function called \"eval\" which will dynamically build new Ruby code based on Strings. It also has a number of ways to call system commands. While the power of these commands is quite useful, extreme care should be taken when using them in a Rails based application. Usually, its just a bad idea. If need be, a whitelist of possible values should be used and any input should be validated as thoroughly as possible. The Ruby Security Reviewer's Guide has a section on injection and there are a number of OWASP references for it, starting at the top: Command Injection."
-
-          super({
-            :name=>"Owasp Ror CheatSheet: Command Injection",
-            :kind=>Dawn::KnowledgeBase::PATTERN_MATCH_CHECK,
-            :applies=>["rails"],
-            :glob=>"*.rb",
-            :aux_links=>["https://www.owasp.org/index.php/Ruby_on_Rails_Cheatsheet"],
-            :message=>message,
-            :attack_pattern => ["eval", "System", "\`", "Kernel.exec"],
-            :avoid_comments => true,
-            :check_family=>:owasp_ror_cheatsheet,
-            :severity=>:info,
-            :mitigation=>"Please validate the code you pass as argument to eval, System, Kernel.exec and friends. If you generate your command line with user controlled values, can lead to an arbitrary code execution."
-          })
-          # @debug = true
-        end
-      end
-    end
-  end
-end

data/lib/dawn/kb/owasp_ror_cheatsheet/csrf.rb

@@ -1,29 +0,0 @@
-module Dawn
-  module Kb
-    module OwaspRorCheatSheet
-      class Csrf
-        include PatternMatchCheck
-
-        def initialize
-          message = "Ruby on Rails has specific, built in support for CSRF tokens. To enable it, or ensure that it is enabled, find the base ApplicationController and look for the protect_from_forgery directive. Note that by default Rails does not provide CSRF protection for any HTTP GET request."
-
-          super({
-            :name=>"Owasp Ror CheatSheet: Cross Site Request Forgery",
-            :kind=>Dawn::KnowledgeBase::PATTERN_MATCH_CHECK,
-            :applies=>["rails"],
-            :glob=>"application_controller.rb",
-            :aux_links=>["https://www.owasp.org/index.php/Ruby_on_Rails_Cheatsheet"],
-            :message=>message,
-            :attack_pattern => ["protect_from_forgery"],
-            :negative_search=>true,
-            :mitigation=>"Make sure you are using Rails protect_from_forgery facilities in application_controller.rMake sure you are using Rails protect_from_forgery facilities in application_controller.rb",
-            :severity=>:info,
-            :check_family=>:owasp_ror_cheatsheet
-          })
-          # @debug = true
-        end
-
-      end
-    end
-  end
-end