Access Control: Infoblox NetMRI < 7.6.1 - Remote Code Execution via Hardcoded Ruby Cookie Secret Key¶

Identifier: infoblox_netmri_rails_cookie_rce

Scanner(s) Support¶

Description¶

Infoblox NetMRI virtual appliances before version 7.6.1 are vulnerable to remote code execution (RCE) due to the use of a hardcoded Ruby on Rails session cookie secret key. The Rails web component deserializes session cookies if the signing key is valid. Attackers with knowledge of this key can craft malicious session cookies that are deserialized by the application, leading to arbitrary code execution. This vulnerability is related to the known Ruby on Rails deserialization flaw (CVE-2013-0156). Infoblox did not assign a new CVE for this issue, as it is a result of the underlying Rails vulnerability.

Reference:

• https://rhinosecuritylabs.com/research/infoblox-multiple-cves/
• https://nvd.nist.gov/vuln/detail/CVE-2013-0156

Configuration¶

Example¶

Example configuration:

---
security_tests:
  infoblox_netmri_rails_cookie_rce:
    assets_allowed:
    - REST
    - GRAPHQL
    - WEBAPP
    skip: false

Reference¶

assets_allowed¶

Type : List[AssetType]*

List of assets that this check will cover.

skip¶

Type : boolean

Skip the test if true.