Penetration Test Report (X41 D-Sec): X41 OSTIF Rails Audit 2025 Public

CodeAuditonRubyonRails
fortheOpenSourceTechnologyImprovementFund
FinalReport(NotforRelease)
2025-06-11
PUBLIC
X41 D-Sec GmbH
Soerser Weg 20
D-52070 Aachen
Amtsgericht Aachen: HRB19989
https://x41-dsec.de/
info@x41-dsec.de
IncooperationwithGitLabInc.
OrganizedbytheOpenSourceTechnologyImprovementFund
CodeAuditonRubyonRails OpenSourceTechnologyImprovementFund
Revision Date Change Author(s)
1 2024-12-23 Initial Threat Model and Test E. Sesterhenn, J. Schneeweisz, R.
Plan Femmer,M.Vervier
2 2025-03-25 FinalReportandManagement E. Sesterhenn, J. Schneeweisz, R.
Summary Femmer,M.Vervier
3 2025-06-11 PublicReportRelease E. Sesterhenn, J. Schneeweisz, R.
Femmer,M.Vervier
X41D-SecGmbH PUBLIC Page1of42
CodeAuditonRubyonRails OpenSourceTechnologyImprovementFund
Contents
1 ExecutiveSummary 4
2 Introduction 6
2.1 Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2.2 Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.3 RecommendedFurtherTests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
3 ThreatModelandTestPlan 9
3.1 SystemOverview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
3.2 AssetsIdentification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
3.3 EntryPoints . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
3.4 TrustBoundaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
3.5 ThreatCategories . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
3.6 SpecificRubyonRailsVulnerabilities . . . . . . . . . . . . . . . . . . . . . . . . . . 16
3.7 ConclusionsandProposedTestPlan . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
4 RatingMethodologyforSecurityVulnerabilities 18
5 Results 20
5.1 Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
5.2 InformationalNotes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
6 AboutX41D-SecGmbH 37
A Appendix 40
A.1 URLParameterFuzzer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
X41D-SecGmbH PUBLIC Page2of42
CodeAuditonRubyonRails OpenSourceTechnologyImprovementFund
Dashboard
Target
Customer OpenSourceTechnologyImprovementFund
Name RubyonRails
Type WebFramework
Version v8.0.1
Engagement
Type GrayBoxPenetrationTest
5: Eric Sesterhenn, Joern Schneeweisz, J.M., Markus Vervier,
Consultants
andRobertFemmer
EngagementEffort 50person-days,2024-12-09to2025-03-25
Totalissuesfound 7
Critical - 0
High - 1 CWE-285(1)
CWE-453(2)
Medium - 0 CWE-502(1)
Low - 6 CWE-657(1) CWE-94(1)
CWE-1395(1)
None - 6
0 1 2 3 4 5 6
Figure1:IssueOverview(l:Severity,r:CWEDistribution)
X41D-SecGmbH PUBLIC Page3of42
CodeAuditonRubyonRails OpenSourceTechnologyImprovementFund
1 Executive Summary
The security review of Ruby on Rails v8.0.1 performed by X41 between December 2024 and
March 2025 has identified several areas where improvements can be made to ensure robust
security.ThetestwasorganizedbytheOpenSourceTechnology-ImprovementFund1.GitLab2
directly supported the assessment by sponsoring participation of the GitLab Security Research
Team3 intheaudit.
A total of seven vulnerabilities were discovered during the test by X41. None were rated as
having a critical severity, one as high, none as medium, and six as low. Additionally, six issues
withoutadirectsecurityimpactwereidentified.
Low - 6
High - 1
Figure1.1:IssuesandSeverity
1https://ostif.org
2https://about.gitlab.com
3https://handbook.gitlab.com/handbook/security/product-security/security-platforms-architectur
e/security-research/
X41D-SecGmbH PUBLIC Page4of42
CodeAuditonRubyonRails OpenSourceTechnologyImprovementFund
The test was performed by five experienced security experts between 2024-12-09 and 2025-
03-25.
During the security code review, various types of attacks were investigated, including authen-
tication bypasses, authorization flaws, cryptographic issues, information exposure, privilege es-
calation, client-side injections, SSRF, race conditions, insecure file operations, and concurrency
issues.
Itshowsthatovertherecentyears,thematurityoftheRailscodebasehasgrownsignificantlyin
regardtosecurity. Issuesidentifiedincludethelackofcomprehensivedeauthenticationmecha-
nismsinActionCable,potentialparsingvulnerabilitiesfordifferentformatslikeJSONandHTTP,
and logical bugs in ActiveStorage that could lead to dangerous file accesses. Additionally, the
reviewhighlightsthird-partydependencyhandlingasanarearequiringfurtherinvestigationdue
toitscriticalroleinsecurity.
Toaddressthesefindings, X41recommendsperformingfollow-uptestssuchascodeauditsof
components used (like the mail library) and assessing popular Gems within the Ruby on Rails
ecosystemforpotentialvulnerabilitiesthatcouldimpactmultipledeployments.
Thesecurityaudithasidentifiedseveralareasofimprovementtoenhancethesecuritypostureof
RubyonRails,focusingoncomponentssuchasActionMailer,ActionMailbox,andActiveStorage.
The recommendations provided will assist in mitigating identified vulnerabilities and ensuring
robustsecuritypracticesareimplemented.
X41D-SecGmbH PUBLIC Page5of42
CodeAuditonRubyonRails OpenSourceTechnologyImprovementFund
2 Introduction
The review of Ruby on Rails by X41 aims to identify security vulnerabilities in the source code
viaamanualreview.
Thethreatmodeldescribedinthechapter3formsthebasisofthisreviewandtheratingsofiden-
tifiedissues.Itisbasedontheassumptionsoftypicalattackersandtheircapabilitiesincommon
usagescenarios.
2.1 Methodology
The review is conducted as a manual code review. X41 adheres to established standards for
sourcecodereviewingandpenetrationtesting. TheseareinparticulartheCERTSecureCoding1
standardsandtheStudy-APenetrationTestingModel2oftheGermanFederalOfficeforInforma-
tionSecurity.
The workflow of source code reviews is shown in figure 2.1. In an initial, informal workshop
regardingthedesignandarchitectureoftheapplication,abasicthreatmodeliscreated. Thisis
usedtoexplorethesourcecodeforinterestingattacksurfacesandcodepaths. Thesearethen
auditedmanuallyandwiththehelpoftoolssuchasstaticanalyzersandfuzzers. Theidentified
issuesaredocumentedandcanbeusedinaGAPanalysistohighlightchangestopreviousaudits.
1https://wiki.sei.cmu.edu/confluence/display/seccode/SEI+CERT+Coding+Standards
2https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Studies/Penetration/penetrati
on_pdf.pdf?__blob=publicationFile&v=1
X41D-SecGmbH PUBLIC Page6of42
CodeAuditonRubyonRails OpenSourceTechnologyImprovementFund
Ini�al Design Threat Code
Workshop Modelling Review
Fixing and GAP / Performance
Documenta�on
Mi�ga�on Analysis
Figure2.1:CodeReviewMethodology
2.2 Scope
ThesourcecodeinscopeforthisauditwasRubyonRailsv8.0.13whichcorrelatestoGitcommit
cf6ff17e9a3c6c1139040b519a341f55f0be16cf4.
Asecurityassessmentattemptstofindthemostimportantorsometimesasmanyoftheexisting
problemsaspossible,thoughitispracticallyneverpossibletoruleoutthepossibilityofadditional
weaknessesbeingfoundinthefuture.
TheActionMailerandActionMailboxcomponentswereinspectedforlogicandimplementation
bugs.
Semgrep5 wasusedforaninitialstaticanalysisofthesourcecode.
• CookieswerecheckedforSecure andHttpOnly attributes.
• Parsingissuesfordifferentformats(JSON,HTTP).
• WebSockethijackingwasinvestigatedusingdynamicandstaticanalysis.
• ThecodewascheckedforURL6 parsingdiscrepancies
3https://github.com/rails/rails/releases/tag/v8.0.1
4https://github.com/rails/rails/tree/cf6ff17e9a3c6c1139040b519a341f55f0be16cf
5https://semgrep.dev/index.html
6UniformResourceLocator
X41D-SecGmbH PUBLIC Page7of42
CodeAuditonRubyonRails OpenSourceTechnologyImprovementFund
TheActionCablecodehasbeenreviewedwithafocusonauthenticationanddeauthentication.
The framework has been inspected for availability and default values of web security features
suchasCSP7,SRI8,HSTS9,Referrer-Policy,X-Content-Type-Options,X-Frame-Options,and
cookieattributessuchas