Security Problem with http authentication in rails

Posted by Blue Box Group on Mon Jun 08 08:07:00 UTC 2009

A potential security concern has been found with the digest authentication code in rails. The code for authenticate_with_http_digest should return true if a user is found, and false if it is not, however a bug was found where the function would return nil if an invalid username was used. The application would continue to process the validation in this case, which would allow an attacker to use an invalid username and blank password to gain access to a protected area of an app.

While this issue will be fixed in the 2.3.3 version of rails, a workaround for existing applications is to ensure that they never return nil. If your code looks like this:

authenticate_or_request_with_http_digest(REALM) do |username| USERS[username] end

…it should instead be changed to return false if the user is not found,

authenticate_or_request_with_http_digest(REALM) do |username| USERS[username] || false end

A full writeup from the rails development team can be found here: <a href=http://weblog.rubyonrails.org/2009/6/3/security-problem-with-authenticate_with_http_digest>http://weblog.rubyonrails.org/2009/6/3/security-problem-with-authenticate_with_http_digest

THE LATEST

THE ARCHIVES

THE FEED