Need

Updating software and dependencies to versions without known vulnerabilities

Context

• Usage of Ruby 2.2.2 as the programming language for development
• Usage of Rails framework for building web applications
• Usage of Nokogiri for HTML and XML parsing and manipulation

Description

Non compliant code

        gem 'rails', '4.2.5'
gem 'nokogiri', '1.6.6.2'
        
        

The above code snippet is a part of the Gemfile in a Ruby on Rails application. This file is used for managing gem dependencies for the application.

In the code, we are using two gems: rails and nokogiri. The version of rails is specified as 4.2.5 and the version of nokogiri as 1.6.6.2.

The vulnerability lies in the fact that these versions of the gems have known security issues:

- Rails 4.2.5 has several known vulnerabilities including potential denial of service, unsafe query generation, and possible XSS vulnerability.

- Nokogiri 1.6.6.2 has a known vulnerability where a specially crafted XML document, if parsed by a Nokogiri application, can cause unsanitized data to be outputted, potentially leading to an XSS attack.

Using software with known vulnerabilities increases the risk of a security breach. Attackers can exploit these known vulnerabilities to gain unauthorized access or disrupt the service. Therefore, it is recommended to keep the software and its dependencies up to date.

Steps

• Identify the known vulnerabilities in the current versions of the software or dependencies.
• Update the software or dependencies to the latest versions that do not have the known vulnerabilities.
• Review the release notes and changelogs of the updated versions to ensure compatibility with the existing codebase.
• Test the updated software or dependencies in a development or staging environment to ensure proper functionality.
• Deploy the updated software or dependencies to the production environment.
• Regularly monitor for new vulnerabilities and update the software or dependencies accordingly.

Compliant code

        gem 'rails', '4.2.5'
gem 'nokogiri', '1.6.6.2'
        
        

The above code is specifying the versions of the 'rails' and 'nokogiri' gems to be used in a Ruby on Rails application. The versions specified ('4.2.5' for Rails and '1.6.6.2' for Nokogiri) are known to have vulnerabilities.

# Solution

To fix this vulnerability, you should update these gems to the latest stable versions that do not have the known vulnerabilities. Here is an example of how you can do this:

                gem 'rails', '6.1.4'
gem 'nokogiri', '1.12.5'

            

References

• 435. Use of software with known vulnerabilities in environments