Need

Prevention of unauthorized disclosure of technical information

Context

• Usage of Ruby programming language for web development
• Usage of Rails framework for building web applications

Description

Non compliant code

        # config/environments/production.rb

Rails.application.configure do
  # ...
  config.middleware.use ::ActionDispatch::DebugExceptions
  # ...
end
        
        

The above code is a configuration setting in a Ruby on Rails application which is set in the production environment. The middleware ActionDispatch::DebugExceptions is used to handle exceptions in a way that it renders a detailed exception page with information about the error occurred, the stack trace, and the environment variables.

This middleware is very useful in the development and test environments where we need to debug our application. However, in the production environment, it could lead to a serious information leak vulnerability. Attackers could intentionally cause exceptions to occur and get detailed information about your system, such as the versions of the libraries you are using, the configuration of your application, and even sensitive data that's stored in the environment variables.

Steps

• Remove or comment out the line 'config.middleware.use ::ActionDispatch::DebugExceptions' in the 'config/environments/production.rb' file.
• Ensure that the 'config/environments/production.rb' file does not contain any other middleware that could potentially leak technical information.
• Review and update the server configuration to disable the display of detailed error messages and sensitive information in the response.
• Consider implementing custom error handling and error pages to provide a more user-friendly experience while avoiding the disclosure of technical information.

Compliant code

        # config/environments/production.rb

Rails.application.configure do
  # ...
  # config.middleware.use ::ActionDispatch::DebugExceptions
  # ...
end
        
        

The above code is a fixed version of the original vulnerable code. The line config.middleware.use ::ActionDispatch::DebugExceptions has been commented out. This middleware was originally included in the production environment configuration, which could lead to the leakage of technical information.

The ActionDispatch::DebugExceptions middleware is a debugging tool that is typically used in the development environment. It catches exceptions and displays them in a user-friendly manner, but it also exposes detailed technical information about the application. This information can be exploited by attackers to gain insights into the internal workings of the application, which can lead to further attacks.

By commenting out this line, we ensure that this middleware is not used in the production environment, thereby preventing the potential information leak.

In addition to this, it is recommended to review and update the server configuration to disable the display of detailed error messages and sensitive information in the response. Consider implementing custom error handling and error pages to provide a more user-friendly experience while avoiding the disclosure of technical information.

References

• 362. Technical information leak - Content response