CSC/ECE 517 Fall 2009/wiki1b 8 va

Ruby and Web Security

This page describes top 25 dangerous programming errors identified by SANS 1 and how Ruby on Rails can mitigate them.

Introduction

Security errors are one of the most serious problems affecting today's applications. These errors can result in many undesirable effects, including lost profits, comprimise of sensitive information, or damage to the system. Ruby on Rails has many features and some clever helper methods that automatically prevent security holes. There are additional tools and plugins for Ruby and Rails that can further reduce the risks. Some of the security errors have not yet been addressed by Ruby and Rails. 3

Built in features that can enhance security

• Safety levels (Ruby) - Ruby can limit how tainted (externally supplied) data is supplied. Meaningful values range from 0 to 4, with 0 being no safety check and increasing levels of security to 4 being the most secure (and most restrictive). Set with $SAFE = number in the Ruby program or the -T command from the command line. [13]
• Parametric Polymorphism (Ruby) - This language feature can handle a wide variety of inputs without crashing, but unexpected inputs may be processed in unexpected ways, causing the need for greater input testing. Tools have been developed to perform this testing.
• protect_from_forgery command (Rails)
• Active Record for SQL Database Manipulation (Rails) - This is a built in class for securely acessing the SQL database.
• Automatically generated finder methods (Rails) - These methods access the database and are secure against SQL injection attacks [14]
• Largely automated design (Ruby and Rails) - This helps reduce coding errors which mitigates some security issues
• Virtual machine (Ruby and Rails) - Code is run by a language interpreter rather than compiled and executed.
• Test case tools such as Test Unit built in to Aptana's Ruby plug-in for Eclipse (Ruby and Rails)

Tools and plugins

• Tarantula - A tool that tests applications for common vulnerabilities. This is new and is still in development.
• R-spec - Another testing unit to be used with eclipse which provides documentation capabilities
• Clearance - A gem used to perform user login with hashed passwords
• Safe-ERB - A plugin used to counteract the Cross Site Scripting attack.
• Sandbox - Prevents damage to other applications
• Ruby-HMAC - Protects cookie information from unauthorized access.

Common security errors and their mitigations [1]

Category: Insecure Interaction Between Components

CWE-20: Improper Input Validation

Ruby and Rails provides Test Unit which should be used to test for this. Polymorphism in Rails makes it very important to perform these checks. Rails has a plugin tarantula, a fuzzy spider. It crawls the rails application, fuzzing inputs and analyzing what comes back. 7

CWE-116: Improper Encoding or Escaping of Output

It is important to escape the output of web applications especially when redisplaying user input that was not input-filtered. Ruby uses escapeHTML() method to replace the HTML input characters &, ", <, > by their uninterpreted representations in HTML (&, ", <, and >). Rails' sanitize() method is a good solution to fend off encoding attacks. Output escaping is easily forgotten by programmer to code. Rails has the SafeErb plugin which reminds the programmer about output escaping if this is forgotten. 2

CWE-89: Failure to Preserve SQL Query Structure (aka 'SQL Injection')

Ruby has a solution for this. Popular goals of SQL injection attacks are to bypass authorization or carry out data manipulation or reading arbitrary data. SQL injection can also happen by influencing database queries by manipulating web application parameters. Ruby on Rails has a built in filter for special SQL characters, which will escape ’, ", NULL character and line breaks. Instead of passing a string to conditions options an array or an hash can be passed to sanitize tainted strings. Furthermore, Rails has predefined Active Record functions to access the database. These functions are designed to prevent SQL injection attacks from succeeding.

• Example: How ruby mitigates problem of bypassing authorization:

   Use of User.find(:first, "login = '#{params[:name]}' AND password = '#{params[:password]}'") 

Input of ’ OR ‘1’=‘1 as name, and ’ OR ’2’>’1 as password will create the following query:

   "SELECT * FROM users WHERE login =  OR '1'='1' AND password =  OR '2'>'1' LIMIT 1"  

The above query will find first record from user table and grant access to the user. In Ruby, Model.find(id) can be used in model to mitigate the problem of bypassing authorization. Array and hash are only available in model. There is one function sanitize_sql() which can be used in other places for this purpose. 2

   Model.find(:first, :conditions => {:login => entered_user_name, :password => entered_password})  

CWE-79: Failure to Preserve Web Page Structure (aka 'Cross-site Scripting(XSS)')

This attack injects client side executable code. Cross site scripting can hijack the session, steal the cookie, display advertisements for the benefit of the attacker, change elements on the web site to get confidential information, redirect the victim to a fake website or install malicious software through security holes in the web browser.

To avoid XSS it is important to filter out malicious inputs and escape output of web application. Rather than blacklisting inputs it is good to create a white list describing the allowed values because blacklist never ends. Rails has helper methods to defend against this problem. Rails has the sanitize() method for this whitelist approach. sanitize() also defends encoding injection attacks. 2

• Example::

   Attacker injects code to show an alert as follows
   strip_tags("some<script>alert('hello')</script>") 
   Use of Rail's sanitize method
   tags = %w(a acronym b strong i em li ul ol h1 h2 h3 h4 h5 h6 blockquote br cite sub sup ins p) 
   s = sanitize(user_input, :tags => tags, :attributes => %w(href title)) 

Safe-ERB is another plugin developed specifically to counter this threat.

CWE-78: Failure to Preserve OS Command Structure (aka 'OS Command Injection')

Ruby has system(command, parameters) method which defends this attack. 2

• Example::

   system("/bin/echo","Hello Sam; rm *")

It prints "Hello Sam; rm*". rm* doesn't work here.

Increasing the $SAFE parameter to 1 or greater should also reduce the potential damage of these attacks.

Since Ruby and Rails are run on a virtual machine, the code is one step removed from the operating system. However, the system command can be used to access operating system commands. As stated above, the system command has some protections, but it is likely to have some vulnerabilities as well.

CWE-319: Cleartext Transmission of Sensitive Information

Transmission of sensitive information in cleartext is a problem because attackers may gain access to it. For example, an attacker may find a username / password transmitted in cleartext and use this to do bad things. A SSL (Secure Socket Layer) plugin is available to prevent the cleartext transmission of sensitive information. To install it, issue the command ruby script/plugin install ssl_requirement. To use it, protect your methods defined in the classes with ssl_required :method1 :method2. ssl_allowed may be used to allow (but not require) the use of SSL. Note that TLS (Transport Layer Security) has replaced SSL, so this may be an outdated solution.

Consideration must also be given to not store sensitive information in the clear. Use Active Record hooks to perform AES128 encryption and decryption. Rails logging may log sensitive information, which could be accessed by attackers. Use the filter_parameter_logging :parameter1 :parameter2 to prevent logging of sensitive parameters. Clear sensitive data as soon as it is no longer needed [14]

CWE-352: Cross-Site Request Forgery '(CSRF)'

Ruby on Rails is equipped to prevent this attack. Rails 2 or higher has a feature called protect_from_forgery which is specifically designed to combat attacks such as this. Use of GET and POST can prevent CSRF. Ruby has a verify method which is defined in controller to make sure that specific actions may not be used over GET. 2

• Example::

   verify :method => :post, :only => [:transfer], :redirect_to => {:action => :list}

In the above example if the transfer action comes from any other web address, it redirects to the action list. So, CSRF will never happen.

CWE-362: Race Condition

Ruby and Rails has testing tools (test unit / R-spec) which may be able to detect this. However, these testing tools may not catch such errors in all cases.

Example::

   Assume these two pieces of code can run in parallel
   Code section A    Code Section B
   @balance = 500    @balance = @balance + 100
   puts @balance

In the above example, the balance will usually read 500 from code section A. However, if the first line of code section A executes, then the Code Section B executes, then the print statement in A executes, the balance would read 600. The standard testing tools would most likely miss this error because it would happen very rarely.

Ruby provides the Mutex class 11 which can partially help avoid race conditions. The shared variable can be locked by one thread while it is being modified, then unlocked when the modification is done. This prevents some of the problems that can arise in race conditions, but can cause other problems, such as deadlock or livelock.

There does not appear to be a complete solution yet for the race condition in Ruby, or in any other languages.

CWE-209: Error Message Information Leak

A very common way of error message information leak is from log files. For any web application programmers should restrict detailed error messages to trusted users only. Programmer may use password encryption everywhere but if they come in clear text in log files then attacker can read that. Ruby has filter_parameter_logging method that can be written in controller to filter confidential parameter values. 2

• Example:

   filter_parameter_logging :password 
   In log files password will be shown as FILTERED.

Category: Risky Resource Management

CWE-119: Failure to Constrain Operations within the Bounds of a Memory Buffer

Ruby doesn't give direct access to memory in comparison to other languages like C or C++. This feature of Ruby defends against this kind of attack.

CWE-642: External Control of Critical State Data

Unprotected data such as cookie information or profile data are vulnerable to attack. So it is very important to protect this information. A common way to do this is to cipher these data using hashed message authentication code(HMAC). Ruby has ruby-hmac interface to provide HMAC functionality. Based on a secret key, HMAC provides integrity check of information stored in or transmitted over an unreliable medium. 6

CWE-73: External Control of File Name or Path

The Ruby $SAFE parameter may be used to protect against this by increasing it a proper value

CWE-426: Untrusted Search Path

Again, the Ruby $SAFE parameter may be used to protect against this by increasing it to a proper value

CWE-94: Failure to Control Generation of Code (aka 'Code Injection')

Ruby allows this, but only if the developer writes the program to allow it. If such functionality is provided in an application, it should be tested extensively. Another mitigation is that Ruby is run in a virtual machine. This somewhat limits the damage that could be done (e.g. someone should not be able to format your C: drive (erase everything) from a remote site through a ruby application. There is still significant risk in allowing users to add their own code, and this functionality should be used sparingly, and tested thoroughly.

CWE-494: Download of Code Without Integrity Check

One way to fend off this attack is to digitally sign all binaries the programmer ship to customers with a private key and certificate issued by a trusted certification authority. Ruby also has features to prevent this attack 5. Sandboxes may be used to limit what damage the code can do, and parsers may be used to check the code before executing it.

CWE-404: Improper Resource Shutdown or Release

Attack can happen from memory leak, freeing invalid pointer, double-freeing etc. Ruby has Memtrack API's to defend this attack. Patches MRI Ruby 1.8.7p72 can be used to add heap dumping, object reference finder, stack dumping or object allocation/deallocation tracking etc. 8 Ruby has memory leak detector also. 9

CWE-665: Improper Initialization

Ruby has fuzzy crawler Tarantula to defend against this. Proper testing can reveal this kind of bug in the code. Ruby has Test unit and R-spec for efficient testing.

CWE-682: Incorrect Calculation

Test tools may be used to spot these errors. Test unit is provided with Rails, and R-spec is another test tool which may be used.

Category: Porous Defenses

• CWE-327: Use of a Broken or Risky Cryptographic Algorithm

There are tools such as Clearance (a password utility), AES 128 encryption and SSL support in Ruby and Rails that provide secure cryptographic algorithims.

• CWE-259: Hard-Coded Password

Rails has Clearance and Cucumber for this. Clearance is a tool for authentication with e-mail and password. Authentication check may be required as the application evolves and cucumber is used for that. 10

• Example::

   def path_to(page_name)
   case page_name
   ...
   when /sign up page/i
   new_user_path
   when /sign in page/i
   new_session_path
   when /password reset request page/i
   new_password_path
   ...
   end

• CWE-732: Insecure Permission Assignment for Critical Resource

Configuration store such as windows registry should be protected and permission given on all objects created in file system should be reviewed. This is mostly a manual effort.

• CWE-330: Use of Insufficiently Random Values

Ruby provides the rand() function, but the default random functions are generally not sufficiently random. Other random number generators, such as these 12 have been developed in Ruby. It is tricky to determine if these, or the default rand() are sufficiently random for the particular application.

• CWE-250: Execution with Unnecessary Privileges

Developers should use the minimum set of privileges required and reduce privileges when they are no longer needed.

• CWE-602: Client-Side Enforcement of Server-Side Security

Active record (within rails) provides the attr_protected method which is used to protect records of the database. This allows the developer to specify which attributes to protect. Alternatively, attr_accessible can be used to protect everything except the values listed. Tarantula may detect this vulnerability through its fuzzed inputs test.

How Ruby and Rails security compares to other platforms

Ruby and Rails are fairly new. Security tools are currently being developed to combat many of the common security errors, but many of these tools have not reached maturity. Some are difficult to locate, install or use. Some are not yet well developed and are likely to miss common flaws. Most other languages have been around for longer so security tools have had more time for improvement.

One positive thing about Ruby and Rails is that they were built with security in mind. If security tools continue to be developed and incorporated into Ruby and Rails, the applications developed on them are likely to become more secure than those developed in other languages. Many languages were not originally developed with security in mind.

References

1. http://www.sans.org/top25errors/#s4 - Lists top 25 errors by category

2. http://guides.rubyonrails.org/security.html - Security features of Ruby

3. http://www.quarkruby.com/2007/9/20/ruby-on-rails-security-guide - Security features of Ruby

4. http://ieeexplore.ieee.org.www.lib.ncsu.edu:2048/stamp/stamp.jsp?tp=&arnumber=5054914&isnumber=5054895 - Top 25 errors

5. http://www.example-code.com/ruby/rubycerts.asp - Digital certificates examples

6. http://github.com/topfunky/ruby-hmac - An implementation of the HMAC message authentication code.

7. http://github.com/relevance/tarantula - A fuzzy spider for data validation

8. http://timetobleed.com/plugging-ruby-memory-leaks-heapstack-dump-patches-to-help-take-out-the-trash/ - Garbage collection in Ruby

9. http://www.softwareverify.com/ruby/memory/index.html - Ruby memory leak detector

10. http://github.com/thoughtbot/clearance/ - Password management using Clearance

11. http://www.ruby-doc.org/core/classes/Mutex.html - Explanation of the Mutex class for Ruby and how to use it

12. http://snippets.dzone.com/posts/show/4697 - Several random number generators written in Ruby

13. Thomas 2006, pp. 398 - 401

14. Ruby 2009, pp. 637 - 650

Books referenced

• Thomas, Dave (2006). Programming Ruby, The Pragmatic Programmers' Guide.
• Ruby, Sam et al. (2009). Agile Web Development with Rails, Third Edition.

External Links

• http://guides.rubyonrails.org/security.html
• http://www.securityinnovation.com/application-security-testing-analysis-training.htm - Security tools for other languages (C++, C#, Java)
• http://www.owasp.org/ - Open Web Security Application Project