dawnscanner 1.6.9 → 2.0.0.rc1

data/lib/dawn/kb/owasp_ror_cheatsheet/mass_assignment_in_model.rb

@@ -1,33 +0,0 @@
-module Dawn
-  module Kb
-    module OwaspRorCheatSheet
-
-      class MassAssignmentInModel
-
-        include PatternMatchCheck
-
-        def initialize
-          message = "Although the major issue with Mass Assignment has been fixed by default in base Rails specifically when generating new projects, it still applies to older and upgraded projects so it is important to understand the issue and to ensure that only attributes that are intended to be modifiable are exposed."
-
-          super({
-            :name=>"Owasp Ror CheatSheet: Mass Assignement in model",
-            :kind=>Dawn::KnowledgeBase::PATTERN_MATCH_CHECK,
-            :applies=>["rails"],
-            :glob=>"**/model/*.rb",
-            :aux_links=>["https://www.owasp.org/index.php/Ruby_on_Rails_Cheatsheet"],
-            :message=>message,
-            :attack_pattern => ["attr_accessor"],
-            :negative_search=>false,
-            :avoid_comments=>true,
-            :check_family=>:owasp_ror_cheatsheet,
-            :severity=>:info,
-            :evidences=>["In one or more of your models, you use attr_accessor attribute modifier. This is risky since it exposes you to a massive assignment vulnerability. You have to carefully handle how your model receive data by setting all attribute to attr_reader and using a setter method validating input before saving to database."],
-            :mitigation=>"Avoid attr_accessor attribute modifier in your models. You must use attr_reader as modifier and carefully filter your inputs before passing to the database layer."
-          })
-          # @debug = true
-        end
-
-      end
-    end
-  end
-end

data/lib/dawn/kb/owasp_ror_cheatsheet/security_related_headers.rb

@@ -1,35 +0,0 @@
-  module Dawn
-    module Kb
-      module OwaspRorCheatSheet
-        class SecurityRelatedHeaders
-          include PatternMatchCheck
-
-          def initialize
-            message = "To set a header value, simply access the response.headers object as a hash inside your controller (often in a before/after_filter). Rails 4 provides the \"default_headers\" functionality that will automatically apply the values supplied. This works for most headers in almost all cases."
-
-            super({
-              :name=>"Owasp Ror CheatSheet: Security Related Headers",
-              :kind=>Dawn::KnowledgeBase::PATTERN_MATCH_CHECK,
-              :applies=>["rails"],
-              :glob=>"**/controllers/*.rb",
-              :aux_links=>["https://www.owasp.org/index.php/Ruby_on_Rails_Cheatsheet"],
-              :message=>message,
-              :attack_pattern => [
-                "response.headers\\['X-Frame-Options'\\] = 'DENY'",
-                "response.headers\\['X-Content-Type-Options'\\] = 'nosniff'",
-                "response.headers\\['X-XSS-Protection'\\] = '1'",
-                "ActionDispatch::Response.default_headers = {
-                    'X-Frame-Options' => 'DENY',
-                    'X-Content-Type-Options' => 'nosniff',
-                    'X-XSS-Protection' => '1;'
-                  }"],
-              :negative_search=>true,
-              :check_family=>:owasp_ror_cheatsheet,
-              :severity=>:info,
-              :mitigation=>"Use response headers like X-Frame-Options, X-Content-Type-Options, X-XSS-Protection in your project."
-            })
-          end
-        end
-      end
-    end
-  end

data/lib/dawn/kb/owasp_ror_cheatsheet/sensitive_files.rb

@@ -1,29 +0,0 @@
-module Dawn
-  module Kb
-    module OwaspRorCheatSheet
-
-      class SensitiveFiles
-        include PatternMatchCheck
-
-        def initialize
-          message = "Many Ruby on Rails apps are open source and hosted on publicly available source code repositories. Whether that is the case or the code is committed to a corporate source control system, there are certain files that should be either excluded or carefully managed." 
-
-          super({
-            :name=>"Owasp Ror CheatSheet: Sensitive Files",
-            :kind=>Dawn::KnowledgeBase::PATTERN_MATCH_CHECK,
-            :applies=>["rails"],
-            :glob=>".gitignore",
-            :aux_links=>["https://www.owasp.org/index.php/Ruby_on_Rails_Cheatsheet"],
-            :message=>message,
-            :check_family=>:owasp_ror_cheatsheet,
-            :severity=>:info,
-            :attack_pattern => ["/config/database.yml", "/config/initializers/secret_token.rb", "/db/seeds.rb", "/db/*.sqlite3"],
-            :mitigation=>"Put sensitive files in your repository gitignore file"
-          })
-          # @debug = true
-
-        end
-      end
-    end
-  end
-end

data/lib/dawn/kb/owasp_ror_cheatsheet/session_stored_in_database.rb

@@ -1,31 +0,0 @@
-module Dawn
-  module Kb
-    module OwaspRorCheatSheet
-
-      class SessionStoredInDatabase
-        include PatternMatchCheck
-
-        def initialize
-          message = "By default, Ruby on Rails uses a Cookie based session store. What that means is that unless you change something, the session will not expire on the server. That means that some default applications may be vulnerable to replay attacks. It also means that sensitive information should never be put in the session."
-
-          super({
-            :name=>"Owasp Ror CheatSheet: Session management",
-            :kind=>Dawn::KnowledgeBase::PATTERN_MATCH_CHECK,
-            :applies=>["rails"],
-            :glob=>"session_store.rb",
-            :aux_links=>["https://www.owasp.org/index.php/Ruby_on_Rails_Cheatsheet"],
-            :message=>message,
-            :attack_pattern => ["Application.config.session_store :active_record_store", "Rails.application.config.session_store ActionDispatch::Session::CacheStore"],
-            :negative_search=>true,
-            :avoid_comments=>true,
-            :check_family=>:owasp_ror_cheatsheet,
-            :severity=>:info,
-            :evidences=>["In your session_store.rb file you are not using ActiveRecord to store session data. This will let rails to use a cookie based session and it can expose your web application to a session replay attack."],
-            :mitigation=>"Use ActiveRecord or the ORM you love most to handle your code session_store. Add \"Application.config.session_store :active_record_store\" to your session_store.rb file."
-          })
-          # @debug = true
-        end
-      end
-    end
-  end
-end

data/lib/dawn/kb/simpleform_xss_20131129.rb

@@ -1,28 +0,0 @@
-module Dawn
-  module Kb
-    # Automatically created with rake on 2013-12-11
-    class SimpleForm_Xss_20131129
-      include DependencyCheck
-
-      def initialize
-        message = "There is a XSS vulnerability on Simple Form's label, hint and error options. When Simple Form creates a label, hint or error message it marks the text as being HTML safe, even though it may contain HTML tags. In applications where the text of these helpers can be provided by the users, malicious values can be provided and Simple Form will mark it as safe."
-
-        super({
-          :name=>"Simple Form XSS - 20131129",
-          :cvss=>"none",
-          :release_date => Date.new(2013, 11, 29),
-          :cwe=>"",
-          :owasp=>"A9", 
-          :applies=>["rails", "padrino", "sinatra"],
-          :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-          :message=>message,
-          :mitigation=>"Please upgrade Simple Form the 3.0.1 and 2.1.1 releases are available at the normal locations.",
-          :aux_links=>["https://groups.google.com/forum/#!topic/ruby-security-ann/flHbLMb07tE"]
-        })
-
-        self.safe_dependencies = [{:name=>"simple_form", :version=>['3.0.1', '2.1.1']}]
-
-      end
-    end
-  end
-end

data/lib/dawn/knowledge_base_experimental.rb

@@ -1,245 +0,0 @@
-require 'singleton'
-
-# For HTTPS communication to check for KB updates and to fetch them
-require 'net/http'
-require 'uri'
-
-require 'yaml'
-require 'digest'
-
-module Dawn
-  # This is the YAML powered experimental knowledge base
-  #
-  # When the old KB format, using Ruby classes will be marked as deprecated,
-  # than this one will be the official.
-  #
-  # Dawnscanner KB will be a bunch of YAML file, stored in a hierachy of
-  # directories resembling security checks family. A digital signature will be
-  # also available to prevent KB tampering.
-  #
-  # This class will be accountable for:
-  #   + check for KB upgrade
-  #   + fetching the KB file from the Internet
-  #   + verifying the database signature
-  #   + reading YAML file, creating the security check array
-  #
-  # Another big change will be the MVC passed as constructor parameter, so only
-  # the checks regarding the particular app, will be loaded in the security
-  # check array. This should speed up BasicCheck internal routines.
-  #
-  # Class usage will be very simple. After getting the singleton instance, you
-  # will load the KB content. The load method will be also responsible about
-  # all relevant checks.
-  #
-  # Example
-  #
-  # require "dawn/knowledge_base_experimental"
-  #
-  # ...
-  #
-  # d = Dawn::KnowledgeBaseExperimental.instance
-  # d.update if d.update?
-  # d.load
-  #
-  # Last update: Fri Oct  7 08:03:43 CEST 2016
-  class KnowledgeBaseExperimental
-    include Dawn::Utils
-    include Singleton
-
-    GEM_CHECK           = :rubygem_check
-    DEPENDENCY_CHECK    = :dependency_check
-    PATTERN_MATCH_CHECK = :pattern_match_check
-    RUBY_VERSION_CHECK  = :ruby_version_check
-    OS_CHECK            = :os_check
-    COMBO_CHECK         = :combo_check
-    CUSTOM_CHECK        = :custom_check
-
-    REMOTE_KB_URL_PREFIX  = "https://dawnscanner.org/data/"
-    FILES = %w(kb.yaml bulletin.tar.gz generic_check.tar.gz owasp_ror_cheatsheet.tar.gz code_style.tar.gz code_quality.tar.gz owasp_top_10.tar.gz signatures.tar.gz)
-
-
-    attr_reader :security_checks
-    attr_reader :descriptor
-    attr_reader :path
-
-    def initialize(options={})
-      if $logger.nil?
-        require 'dawn/logger'
-        $logger = Logger.new(STDOUT)
-        $logger.helo "knowledge-base-experimental", Dawn::VERSION
-      end
-    end
-
-
-
-    def find(name)
-    end
-
-    def self.kb_descriptor
-      {:kb=>{:version=>"0.0.1", :revision=>Time.now.strftime("%Y%m%d"), :api=>Dawn::VERSION}}.to_yaml
-    end
-
-    def update?
-      FileUtils.mkdir_p("tmp")
-      begin
-        response = Net::HTTP.get URI(REMOTE_KB_URL_PREFIX + "kb.yaml")
-        open("tmp/kb.yaml", "w") do |f|
-          f.puts(response)
-        end
-        response = Net::HTTP.get URI(REMOTE_KB_URL_PREFIX + "kb.yaml.sig")
-        open("tmp/kb.yaml.sig", "w") do |f|
-          f.puts(response)
-        end
-      rescue Exception => e
-        $logger.error e.to_s
-        return false
-      end
-
-      # Verify kb.yaml signature
-
-      YAML.load(response)
-    end
-
-    def all
-      @security_checks
-    end
-
-    # Load security checks from db/ folder.
-    #
-    # options - The list of the options to be passed to KB. It can contain:
-    #   + enabled_checks: an array of security checks that must be enabled
-    #      [:generic_check, :code_quality, :bulletin, :code_style, :owasp_ror_cheatsheet, :owasp_top_10]
-    #   + mvc: the mvc name for the target application, in order for the KB to
-    #          deselect all security checks that don't fit the code to be
-    #          reviewed.
-    #   + path: the path for the KB root folder. Please note that #{Dir.pwd}/db
-    #           is the default location.
-    #
-    # Returns an array of security checks, matching the mvc to be reviewed and
-    # the enabled check list or an empty array if an error occured.
-    def load(options={})
-      @security_checks = []
-      $path = File.join(Dir.pwd, "db")
-
-      enabled_checks  = options[:enabled_checks]  unless options[:enabled_checks].nil?
-      mvc             = options[:mvc]             unless options[:mvc].nil?
-      $path           = options[:path]            unless options[:path].nil?
-
-      unless __valid?
-        $logger.error "An invalid library it has been found. Please use --recovery flag to force fresh install from dawnscanner.org"
-        return []
-      end
-
-      unless __load?
-        $logger.error "The library must be consumed with dawnscanner up to v#{$descriptor["kb"]["api"]}. You are using dawnscanner v#{Dawn::VERSION}"
-        return []
-      end
-
-      # TODO: untar and unzip from here (look for it in Google)
-      if __packed?
-        $logger.info "a packed knowledge base it has been found. Unpacking it"
-        __unpack
-      end
-
-      enabled_checks.each do |d|
-
-        dir = File.join($path, d)
-
-        # Please note that if we enter in this branch, it means someone
-        # tampered the KB between the previous __valid? check and this point.
-        # Of course this is a very rare situation, but we must handle it.
-        unless Dir.exists?(dir)
-          $logger.critical "Missing check directory #{dir}"
-          $logger.error "An invalid library it has been found. Please use --recovery flag to force fresh install from dawnscanner.org"
-          return []
-        end
-
-        # Enumerate all YAML file in the give dir
-
-      end
-
-    end
-
-    def dump(verbose=false)
-      puts "Security checks currently supported:"
-      i=0
-      KnowledgeBaseExperimental.instance.all.each do |check|
-        i+=1
-        if verbose
-          puts "Name: #{check.name}\tCVSS: #{check.cvss_score}\tReleased: #{check.release_date}"
-          puts "Description\n#{check.message}"
-          puts "Remediation\n#{check.remediation}\n\n"
-        else
-          puts "#{check.name}"
-        end
-      end
-      puts "-----\nTotal: #{i}"
-
-    end
-
-    private
-
-    def __verify_hash(original, computed)
-      t=original.split(' ')
-      return false if t.length != 2
-      return (t[0] == computed)
-    end
-
-    def __valid?
-
-      lines = ""
-
-      unless File.exists?(File.join($path, "kb.yaml"))
-        $logger.error  "Missing kb.yaml in #{path}. Giving up"
-        return false
-      end
-
-      unless File.exists?(File.join($path, "kb.yaml.sig"))
-        $logger.error  "Missing kb.yaml signature in #{path}. Giving up"
-        return false
-      end
-
-      lines = File.read(File.join($path, "kb.yaml"))
-      hash_file = Digest::SHA256.hexdigest lines
-      hash_orig = File.read(File.join($path, "kb.yaml.sig"))
-
-      v = __verify_hash(hash_orig, hash_file)
-      if v
-        $logger.info("good kb.yaml file found. Reading knowledge base descriptor")
-        @descriptor = YAML.load(lines)
-      else
-        $logger.error("kb.yaml signature mismatch. Found #{hash_file} while expecting #{hash_orig}. Giving up")
-        return false
-      end
-
-      return true
-    end
-
-    # Check if the local KB is packet or not.
-    #
-    # Returns true if at least one KB tarball file it has been found in the
-    # local DB path
-    def __packed?
-      FILES.each do |fn|
-        return true if fn.end_with? 'tar.gz' and File.exists?(File.join($path, fn))
-      end
-      return false
-    end
-
-    def __unpack
-
-    end
-
-    def __load?
-      api = $descriptor["kb"]["api"]
-      v = Dawn::VERSION
-      require "dawn/kb/version_check"
-
-      vc = VersionCheck.new
-      return true if vc.is_higher?(api, v) # => true if v > api
-      return false
-    end
-
-
-  end
-end

data/spec/lib/kb/cve_2011_2705_spec.rb

@@ -1,35 +0,0 @@
-require 'spec_helper'
-describe "The CVE-2011-2705 vulnerability" do
-	before(:all) do
-		@check = Dawn::Kb::CVE_2011_2705.new
-		# @check.debug = true
-	end
-  it "fires when ruby 1.8.7-p351 is detected" do
-    @check.detected_ruby ={:engine=>"ruby", :version=>"1.8.7", :patchlevel=>"p351"}
-    expect(@check.vuln?).to eq(true)
-  end
-  it "fires when ruby 1.9.0 any patchlevel is detected" do
-    @check.detected_ruby ={:engine=>"ruby", :version=>"1.9.0", :patchlevel=>"p351"}
-    expect(@check.vuln?).to eq(true)
-  end
-  it "fires when ruby 1.9.1 any patchlevel is detected" do
-    @check.detected_ruby ={:engine=>"ruby", :version=>"1.9.1", :patchlevel=>"p351"}
-    expect(@check.vuln?).to eq(true)
-  end
-  it "fires when ruby 1.9.2-p289 is detected" do
-    @check.detected_ruby ={:engine=>"ruby", :version=>"1.9.2", :patchlevel=>"p289"}
-    expect(@check.vuln?).to eq(true)
-  end
-  it "doesn't fire when ruby 1.8.7-p352 is detected" do
-    @check.detected_ruby ={:engine=>"ruby", :version=>"1.8.7", :patchlevel=>"p352"}
-    expect(@check.vuln?).to eq(false)
-  end
-  it "doesn't fire when ruby 1.9.2-p290 is detected" do
-    @check.detected_ruby ={:engine=>"ruby", :version=>"1.9.2", :patchlevel=>"p290"}
-    expect(@check.vuln?).to eq(false)
-  end
-  it "doesn't fire when ruby 1.9.3-p290 is detected" do
-    @check.detected_ruby ={:engine=>"ruby", :version=>"1.9.3", :patchlevel=>"p290"}
-    expect(@check.vuln?).to eq(false)
-  end
-end

data/spec/lib/kb/cve_2011_2930_spec.rb

@@ -1,31 +0,0 @@
-require 'spec_helper'
-describe "The CVE-2011-2930 vulnerability" do
-  before(:all) do
-    @check = Dawn::Kb::CVE_2011_2930.new
-    # @check.debug = true
-  end
-  it "fires when vulnerable rails version is used (2.3.12)" do
-    @check.dependencies = [{:name=>"rails", :version=>'2.3.12'}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "fires when vulnerable rails version is used (3.0.9)" do
-    @check.dependencies = [{:name=>"rails", :version=>'3.0.9'}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "fires when vulnerable rails version is used (3.1.0)" do
-    @check.dependencies = [{:name=>"rails", :version=>'3.1.0'}]
-    expect(@check.vuln?).to   eq(true)
-  end
-  it "doesn't fire when safe rails version is used (2.3.14)" do
-    @check.dependencies = [{:name=>"rails", :version=>'2.3.14'}]
-    expect(@check.vuln?).to   eq(false)
-  end
-  it "doesn't fire when safe rails version is used (3.0.10)" do
-    @check.dependencies = [{:name=>"rails", :version=>'3.0.10'}]
-    expect(@check.vuln?).to   eq(false)
-  end
-  it "doesn't fire when safe rails version is used (3.1.1)" do
-    @check.dependencies = [{:name=>"rails", :version=>'3.1.1'}]
-    expect(@check.vuln?).to   eq(false)
-  end
-end