Skip to main content

Use of software with known vulnerabilities in environments

Need​

Updating software and dependencies to versions without known vulnerabilities

Context​

  • Usage of Ruby 2.2.2 as the programming language for development
  • Usage of Rails framework for building web applications
  • Usage of Nokogiri for HTML and XML parsing and manipulation

Description​

Non compliant code​

gem 'rails', '4.2.5'
gem 'nokogiri', '1.6.6.2'

The above code snippet is a part of the Gemfile in a Ruby on Rails application. This file is used for managing gem dependencies for the application.

In the code, we are using two gems: rails and nokogiri. The version of rails is specified as 4.2.5 and the version of nokogiri as 1.6.6.2.

The vulnerability lies in the fact that these versions of the gems have known security issues:

  • Rails 4.2.5 has several known vulnerabilities including potential denial of service, unsafe query generation, and possible XSS vulnerability.

  • Nokogiri 1.6.6.2 has a known vulnerability where a specially crafted XML document, if parsed by a Nokogiri application, can cause unsanitized data to be outputted, potentially leading to an XSS attack.

Using software with known vulnerabilities increases the risk of a security breach. Attackers can exploit these known vulnerabilities to gain unauthorized access or disrupt the service. Therefore, it is recommended to keep the software and its dependencies up to date.

Steps​

  • Identify the known vulnerabilities in the current versions of the software or dependencies.
  • Update the software or dependencies to the latest versions that do not have the known vulnerabilities.
  • Review the release notes and changelogs of the updated versions to ensure compatibility with the existing codebase.
  • Test the updated software or dependencies in a development or staging environment to ensure proper functionality.
  • Deploy the updated software or dependencies to the production environment.
  • Regularly monitor for new vulnerabilities and update the software or dependencies accordingly.

Compliant code​

gem 'rails', '4.2.5'
gem 'nokogiri', '1.6.6.2'

The above code is specifying the versions of the 'rails' and 'nokogiri' gems to be used in a Ruby on Rails application. The versions specified ('4.2.5' for Rails and '1.6.6.2' for Nokogiri) are known to have vulnerabilities.

Solution

To fix this vulnerability, you should update these gems to the latest stable versions that do not have the known vulnerabilities. Here is an example of how you can do this:

gem 'rails', '6.1.4'
gem 'nokogiri', '1.12.5'

Please note that the versions specified above are just examples. You should always check for the latest stable versions of these gems.

After updating the gem versions in your Gemfile, run bundle update to update the gems in your application.

Additional Steps

  • Review the release notes and changelogs of the updated versions to ensure compatibility with your existing codebase.
  • Test the updated software or dependencies in a development or staging environment before deploying to production.
  • Regularly monitor for new vulnerabilities and update your software or dependencies as necessary.

References​

Last updated on