Class: Spektr::Checks::JsonParsing

Inherits:
Base
  • Object
show all
Defined in:
lib/spektr/checks/json_parsing.rb

Instance Attribute Summary

Attributes inherited from Base

#name

Instance Method Summary collapse

Methods inherited from Base

#app_version_between?, #dupe?, #model_attribute?, #should_run?, #target_affected?, #user_input?, #version_affected, #version_between?, #warn!

Constructor Details

#initialize(app, target) ⇒ JsonParsing

Returns a new instance of JsonParsing.



4
5
6
7
8
9
 
# File 'lib/spektr/checks/json_parsing.rb', line 4

def initialize(app, target)
  super
  @name = "JSON parsing vulnerability"
  @type = "Remote Code Execution"
  @targets = ["Spektr::Targets::Base"]
end

Instance Method Details

#check_cve_2013_0269 ⇒ Object 



33
34
35
36
37
38
39
40
41
42
43
44
 
# File 'lib/spektr/checks/json_parsing.rb', line 33

def check_cve_2013_0269
  ["json", "json_pure"].each do |gem_name|
    if g = @app.gem_specs&.find { |g| g.name == gem_name }
      if version_between?("1.7.0", "1.7.6", g.version)
        warn! "Gemfile", self, nil, "Unsafe Object Creation Vulnerability in the #{g.name} gem"
      end
      if version_between?("0", "1.5.4", g.version) || version_between?("1.6.0", "1.6.7", g.version)
        warn! "Gemfile", self, nil, "Unsafe Object Creation Vulnerability in the  #{g.name} gem"
      end
    end
  end
end

#check_cve_2013_0333 ⇒ Object 



17
18
19
20
21
22
23
 
# File 'lib/spektr/checks/json_parsing.rb', line 17

def check_cve_2013_0333
  return unless app_version_between?("0.0.0", "2.3.15") || app_version_between?("3.0.0", "3.0.19")
  if @app.has_gem?("yajl")
    warn! "root", self, nil, "Remote Code Execution CVE_2013_0333"
  end
  uses_json_gem?
end

#run ⇒ Object 



11
12
13
14
15
 
# File 'lib/spektr/checks/json_parsing.rb', line 11

def run
  return unless super
  check_cve_2013_0333
  check_cve_2013_0269
end

#uses_json_gem? ⇒ Boolean

Returns:

  • (Boolean) 


25
26
27
28
29
30
31
 
# File 'lib/spektr/checks/json_parsing.rb', line 25

def uses_json_gem?
  @target.find_calls(:backend=).each do |call|
    if call.receiver.expanded == "ActiveSupport.JSON" && call.arguments.first&.name == :JSONGem
      warn! @target, self, call.location, "Remote Code Execution CVE_2013_0333"
    end
  end
end