simulacre/pry-remote-em — Issue #26: [SECURITY BUG] Class shown when a user enters the wrong password
Author: envygeeks
Created: 2012-02-04 16:46:42+00:00
State: open

While configuring Pry for the pry developers today and doing some of the most basic security tests on our server I decided to see how well it could handle authentication and it's basic, I put in the wrong password and it showed me everything in the class it init.

jordon@envygeeks:~ % pry-remote-em pryem://pry01.envygeeks.com:1337
[pry-remote-em] client connected
[pry-remote-em] remote is PryRemoteEm 0.4.2 pryem
user: envygeeks
envygeeks's password: ****

Frame number: 0/0
From: /home/pry/.bin/pry_server @ line 16 in Foo#initialize:

11:
12: require 'pry-remote-em/server'
13:
14: class Foo
15: def initialize
=> 16: binding.remote_pry_em('10.4.5.71', 1337, auth: $auth)
17: end
18: end
19:
20: EM.run do
21: Foo.new

If somebody were to create a blank class and put the passwords hash in that class, it would render the entire point of auth moot.