Our store on Shopify is now subject to quarterly pci-dss vulnerability scans. We’ve had two scans so far. The scans are performed by Security Metrics (not our choice, its our bank’s choosing).
We’ve got two vulnerability fails, one which I have managed to get accepted as a false positive thanks to a post on here (multiple dangerous cgi script detection).
And the second shown below, we have no idea about how to proceed. Hence me reaching out to the community here.
Neither of these came up on the first scan 3 months ago. So it is quite incredible given nothing has changed with our store and the Ruby on Rails cvve referenced is circa 2007.
Really hoping someone here can help!
thanks J
Title
Ruby on Rails Multiple Method Session Fixation
Synopsis
The remote web server is affected by a session fixation vulnerability.
Impact
The web server on the remote host appears to be a version of Ruby on Rails that supports URL-based sessions. An unauthenticated, remote attacker may be able to leverage this issue to obtain an authenticated session. Note that Ruby on Rails version 1.2.4 was initially supposed to address this issue, but its session fixation logic only works for the first request, when CgiRequest is first instantiated. See also : http://www.nessus.org/u?d4902c46http://www.nessus.org/u?d79d2646http://www.nessus.org/u?abd8800dhttp://www.nessus.org/u?0bcaddc8
Resolution
Upgrade to Ruby on Rails version 1.2.6 or later and make sure ‘config.action_controller.session_options[:cookie_only]’ is set to ‘true’ in the ‘config/environment.rb’ file.
Hi, @dublove . Thank you for sharing all of that context!
I’ve checked with our team and can confirm we are on a much newer version of Ruby on Rails than the one the scan has identified. Automated scanning tools are prone to false positives so this is likely what happened. If you have a proof of concept exploit, for instance, an example of an HTTP request that can be exploited, I’d recommend using our Hackerone Bug Bounty program so we can investigate it.
Thanks for looking into this really appreciated. Is there any chance you can confirm the current RoR version Shopify is on?
Security Metrics do like specifics when making a false positive submission. Want to get as much info as I can to put in front of them.
If they are on a newer version than what the scan detected, we would need something to confirm or verify this if possible.
Our scan is external, and can only work off the information provided by the site, this means if it is a situation of having back ported patches or fixes we are unable to identify these.
If it is possible to get confirmation of the version, or even confirmation of CVE-2007-6077 and CVE-2007-5380 being resolved, that would be immensely helpful to a false positive.
I connected with our developers and I can confirm that Shopify is running on the the latest main branch rails version of the https://github.com/rails/rails repository. We are using the following dependency (as of July 29th, 2024):
Shopify is a main contributor to “rails” and we are generally always going to be running the most current version. Please let me know if there is anything else I can help with. If you need further documentation or information for your PCI scan I recommend connecting with our authenticated chat support team so we can have this escalated.
