Ruby on Rails Multiple Method Session Fixation

medium Nessus Plugin ID 28333

Language:

Synopsis

The remote web server is affected by a session fixation vulnerability.

Description

The web server on the remote host appears to be a version of Ruby on Rails that supports URL-based sessions. An unauthenticated, remote attacker may be able to leverage this issue to obtain an authenticated session.

Note that Ruby on Rails version 1.2.4 was initially supposed to address this issue, but its session fixation logic only works for the first request, when CgiRequest is first instantiated.

Solution

Upgrade to Ruby on Rails version 1.2.6 or later and make sure 'config.action_controller.session_options[:cookie_only]' is set to 'true' in the 'config/environment.rb' file.

Plugin Details

Severity: Medium

ID: 28333

File Name: ror_session_fixation.nasl

Version: 1.17

Type: remote

Family: Web Servers

Published: 11/28/2007

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.3

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/a:rubyonrails:ruby_on_rails

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Ease: No known exploits are available

Reference Information

CVE: CVE-2007-5380, CVE-2007-6077

BID: 26096, 26598

CWE: 362

Detections

Analytics