wagn/wagn — Issue #17: Nessus finds a cookie injection security hole
Author: charl
Created: 2011-12-06 22:33:46+00:00
State: open

Nessus finds a cookie injection security hole when requesting a card like:

/

Here's the nessus violation text:

Web Server Generic Cookie Injection

Synopsis :

The remote web server is prone to a cookie injection attack.

Description :

The remote host is running a web server that fails to adequately
sanitize request strings of malicious JavaScript. By leveraging this
issue, an attacker may be able to inject arbitrary cookies. Depending
on the structure of the web application, it may be possible to launch
a 'session fixation' attack using this mechanism.

Please note that :

- Nessus did not check if the session fixation attack is
feasible.

- This is not the only vector of session fixation.

See also :

http://en.wikipedia.org/wiki/Session_fixation
http://www.owasp.org/index.php/Session_Fixation
http://www.acros.si/papers/session_fixation.pdf
http://projects.webappsec.org/Session-Fixation

Solution :

Contact the vendor for a patch or upgrade.

Risk factor :

Medium / CVSS Base Score : 4.3
(CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N)

Plugin output :

The request string used to detect this flaw was :

/

The output was :

HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Wed, 30 Nov 2011 01:38:47 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive
Status: 200
X-Powered-By: Phusion Passenger (mod_rails/mod_rack) 3.0.11
ETag: "41c2079201b3b76a689d9f1fc123c34f"
X-Runtime: 88
Content-Length: 5109
Set-Cookie: wagn_production=BAh7BzoPc2Vzc2lvbl9pZCIlNWE3MWUxNzAzODRlZWMyNjM3NWE4NjhiMzgzYzk5MjQ6DGhpc3RvcnlbBiIGLw%3D%3D--2a8de202b1e8b2c52f94a1f4a4937cb0383dc701; path=/; HttpOnly
Cache-Control: private, max-age=0, must-revalidate

[...]

There's no card named .

Sign In or Sign Up to create it.

[...]

Nessus ID : 44135

The issue seems to be the unfiltered use of card.name in app/views/card/missing.rhtml:

6

There's no card named <%= @card.name %>.

<%#ENGLISH%>

The fix could be:

6

There's no card named <%= strip_tags card.name %>.

<%#ENGLISH%>