2009-06-09T00:56:39Z <p style="text-align: justify;"><span style="font-family: Comic Sans MS;">A security problem has been reported with the digest authentication code in Ruby on Rails. This vulnerability can allow users to bypass your password protection. This vulnerability has been publicly disclosed on several websites, users are advised to take the mitigating steps described below immediately.</span></p> <p style="text-align: justify;"><span style="font-family: Comic Sans MS;">The issue comes from the handling of the block passed to <ins>authenticate_or_request_with_http_digest</ins>. This block must return the user&rsquo;s password in the clear, or a sha1 hash of the user&rsquo;s password. Unfortunately the documentation was unclear on this and the examples cited would return <strong>nil</strong> if the user was not found. The correct behaviour if the user doesn&rsquo;t exist is to return <strong>false</strong>.</span></p> <p style="text-align: justify;"><span style="font-family: Comic Sans MS;">If the return value was nil, rails proceeded to verify this value against the provided password. Because of this an attacker can provide an invalid username and no password and authentication will succeed.</span></p> <h2 style="text-align: justify;"><span style="font-family: Comic Sans MS;">Fixed Versions</span></h2> <p style="text-align: justify;"><span style="font-family: Comic Sans MS;">We have altered the behaviour of the relevant code to make <ins>nil</ins> an authentication failure. This fix has been pushed to 2-3-stable and will be present in 2.3.3 due to be released in the next few days. All versions of edge rails after commit </span><a href="http://github.com/rails/rails/commit/1ad57cfe2fbda58439e4b7f84008ad23bc68e8b0"><span style="font-family: Comic Sans MS;">1ad57cfe2fbda58439e4b7f84008ad23bc68e8b0</span></a><span style="font-family: Comic Sans MS;"> contain the fix.</span></p> <h2>Steps to Protect your application.</h2> <p>Users can protect themselves without upgrading by simply ensuring that their authentication blocks never return nil. To take an example from the documentation:</p> <pre><code>authenticate_or_request_with_http_digest(REALM) do |username|<br /> USERS[username]<br />end</code></pre> <p>Should instead be something like:</p> <pre><code>authenticate_or_request_with_http_digest(REALM) do |username|<br /> USERS[username] || false<br />end</code></pre> 5 2009-06-09T00:55:00Z 2009-06-09T01:15:59Z