CVE-2013-7222: Cryptographic Issues (CWE-310)
value: config/initializers/secret_token.rb in Fat Free CRM before 0.12.1 has a fixed FatFreeCRM::Application.config.secret_token value, which makes it easier for remote attackers to spoof signed cookies by referring to the key in the source code.
CWE description: Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
Published: 2014-01-02T14:59Z
Repository: https://github.com/fatfreecrm/fat_free_crm
Language: Other
Files changed: config/initializers/secret_token.rb, lib/tasks/ffcrm/secret.rake
Commit date: 2013-12-27 09:56:49 +0800
Commit message: Strengthen case to generate unique secret token.

Diff: diff --git a/config/initializers/secret_token.rb b/config/initializers/secret_token.rb
index a37b91d9..d3da066b 100644
--- a/config/initializers/secret_token.rb
+++ b/config/initializers/secret_token.rb
@@ -1,18 +1,25 @@
 # Copyright (c) 2008-2013 Michael Dvorkin and contributors.
 #
 # Fat Free CRM is freely distributable under the terms of MIT license.
 # See MIT-LICENSE file or http://www.opensource.org/licenses/mit-license.php
 #------------------------------------------------------------------------------
+
 # Be sure to restart your server when you modify this file.
 
-# Your secret key for verifying the integrity of signed cookies.
+# Your secret key is used for verifying the integrity of signed cookies.
 # If you change this key, all old signed cookies will become invalid!
+
 # Make sure the secret is at least 30 characters and all random,
 # no regular words or you'll be exposed to dictionary attacks.
+# You can use `rake secret` to generate a secure secret key.
 
-# PLEASE NOTE: This secret token must be changed in your fork of Fat Free CRM.
-# This problem is mitigated when running Fat Free CRM as a Rails Engine.
+# Make sure your secret_key_base is kept private
+# if you're sharing your code publicly.
 
 if defined?(FatFreeCRM::Application)
-  FatFreeCRM::Application.config.secret_token = '51aa366864a80316a85cff0d3762347f4ae3d029d548bef034d56e82b1a2ffac5353ee6719d9b64e4354e2a0b1a901679f46a851c360a2ea377188e4b196b6b6'
+  if Rails.env == 'test'
+    FatFreeCRM::Application.config.secret_token = '51aa366864a80316a85cff0d3762347f4ae3d029d548bef034d56e82b1a2ffac5353ee6719d9b64e4354e2a0b1a901679f46a851c360a2ea377188e4b196b6b6'
+  else
+    raise "Please run 'rake ffcrm:secret' to generate a secret token."
+  end
 end
diff --git a/lib/tasks/ffcrm/secret.rake b/lib/tasks/ffcrm/secret.rake
new file mode 100644
index 00000000..17764c8c
--- /dev/null
+++ b/lib/tasks/ffcrm/secret.rake
@@ -0,0 +1,17 @@
+# Copyright (c) 2008-2013 Michael Dvorkin and contributors.
+#
+# Fat Free CRM is freely distributable under the terms of MIT license.
+# See MIT-LICENSE file or http://www.opensource.org/licenses/mit-license.php
+#------------------------------------------------------------------------------
+
+namespace :ffcrm do
+
+  desc "Generate a secret token for Rails to use."
+  task :secret do
+    require 'securerandom'
+    secret = SecureRandom.hex(64)
+    filename = File.join(Rails.root, 'config', 'initializers', 'secret_token.rb')
+    File.open(filename, 'w'){|f| f.puts "FatFreeCRM::Application.config.secret_token = '#{secret}'"}
+  end
+
+end

Vulnerable code: # Your secret key for verifying the integrity of signed cookies.
# PLEASE NOTE: This secret token must be changed in your fork of Fat Free CRM.
# This problem is mitigated when running Fat Free CRM as a Rails Engine.
  FatFreeCRM::Application.config.secret_token = '51aa366864a80316a85cff0d3762347f4ae3d029d548bef034d56e82b1a2ffac5353ee6719d9b64e4354e2a0b1a901679f46a851c360a2ea377188e4b196b6b6'
Fixed code: 
# Your secret key is used for verifying the integrity of signed cookies.

# You can use `rake secret` to generate a secure secret key.
# Make sure your secret_key_base is kept private
# if you're sharing your code publicly.
  if Rails.env == 'test'
    FatFreeCRM::Application.config.secret_token = '51aa366864a80316a85cff0d3762347f4ae3d029d548bef034d56e82b1a2ffac5353ee6719d9b64e4354e2a0b1a901679f46a851c360a2ea377188e4b196b6b6'
  else
    raise "Please run 'rake ffcrm:secret' to generate a secret token."
  end
# Copyright (c) 2008-2013 Michael Dvorkin and contributors.
#
# Fat Free CRM is freely distributable under the terms of MIT license.
# See MIT-LICENSE file or http://www.opensource.org/licenses/mit-license.php
#------------------------------------------------------------------------------

namespace :ffcrm do

  desc "Generate a secret token for Rails to use."
  task :secret do
    require 'securerandom'
    secret = SecureRandom.hex(64)
    filename = File.join(Rails.root, 'config', 'initializers', 'secret_token.rb')
    File.open(filename, 'w'){|f| f.puts "FatFreeCRM::Application.config.secret_token = '#{secret}'"}
  end

end