Class: Spektr::Checks::DigestDos

Inherits:
Base
  • Object
show all
Defined in:
lib/spektr/checks/digest_dos.rb

Instance Attribute Summary

Attributes inherited from Base

#name

Instance Method Summary collapse

Methods inherited from Base

#app_version_between?, #dupe?, #model_attribute?, #target_affected?, #user_input?, #version_affected, #version_between?, #warn!

Constructor Details

#initialize(app, target) ⇒ DigestDos

Returns a new instance of DigestDos.



4
5
6
7
8
9
 
# File 'lib/spektr/checks/digest_dos.rb', line 4

def initialize(app, target)
  super
  @name = "DoS in digest authentication(CVE-2012-3424)"
  @type = "Denial of Service"
  @targets = ["Spektr::Targets::Base", "Spektr::Targets::Controller"]
end

Instance Method Details

#run ⇒ Object 



11
12
13
14
15
16
17
18
19
20
21
 
# File 'lib/spektr/checks/digest_dos.rb', line 11

def run
  return unless super
  return unless should_run?
  calls = @target.find_calls(:authenticate_or_request_with_http_digest)
  calls.concat(@target.find_calls(:authenticate_with_http_digest))
  if calls.any?
    warn! @target, self, calls.first.location, "Vulnerability in digest authentication CVE-2012-3424"
  else
    warn! "root", self, nil, "Vulnerability in digest authentication CVE-2012-3424"
  end
end

#should_run? ⇒ Boolean

Returns:

  • (Boolean) 


23
24
25
 
# File 'lib/spektr/checks/digest_dos.rb', line 23

def should_run?
  app_version_between?("3.0.0", "3.0.15") || app_version_between?("3.1.0", "3.1.6") || app_version_between?("3.2.0", "3.2.5")
end