The web server on the remote host appears to be a version of Ruby on Rails that supports URL-based sessions.  An unauthenticated, remote attacker may be able to leverage this issue to obtain an authenticated session. 

Note that Ruby on Rails version 1.2.4 was initially supposed to address this issue, but its session fixation logic only works for the first request, when CgiRequest is first instantiated.

リモートホスト上の Web サーバーは、URL ベースのセッションをサポートするバージョンの Ruby on Rails のようです。認証されていないリモート攻撃者は、この問題を利用して、認証されたセッションを得ることができる場合があります。 

Ruby on Rails バージョン 1.2.4 は、当初この問題に対処すると考えられていましたが、そのセッション固定ロジックは、CgiRequest が最初にインスタンス化される場合に、最初のリクエストに対してのみ機能することに注意してください。

The remote host is affected by the vulnerability described in GLSA-200912-02 (Ruby on Rails: Multiple vulnerabilities)

    The following vulnerabilities were discovered:
    sameer     reported that lib/action_controller/cgi_process.rb removes the     :cookie_only attribute from the default session options     (CVE-2007-6077), due to an incomplete fix for CVE-2007-5380 (GLSA     200711-17).
    Tobias Schlottke reported that the :limit and     :offset parameters of ActiveRecord::Base.find() are not properly     sanitized before being processed (CVE-2008-4094).
    Steve from     Coderrr reported that the CRSF protection in protect_from_forgery()     does not parse the text/plain MIME format (CVE-2008-7248).
    Nate reported a documentation error that leads to the assumption     that a block returning nil passed to     authenticate_or_request_with_http_digest() would deny access to the     requested resource (CVE-2009-2422).
    Brian Mastenbrook reported     an input sanitation flaw, related to multibyte characters     (CVE-2009-3009).
    Gabe da Silveira reported an input sanitation     flaw in the strip_tags() function (CVE-2009-4214).
    Coda Hale     reported an information disclosure vulnerability related to HMAC     digests (CVE-2009-3086).
  Impact :

    A remote attacker could send specially crafted requests to a vulnerable     application, possibly leading to the execution of arbitrary SQL     statements or a circumvention of access control. A remote attacker     could also conduct session fixation attacks to hijack a user's session     or bypass the CSRF protection mechanism, or furthermore conduct     Cross-Site Scripting attacks or forge a digest via multiple attempts.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-200711-17 (Ruby on Rails: Multiple vulnerabilities)

    candlerb found that ActiveResource, when processing responses using the     Hash.from_xml() function, does not properly sanitize filenames     (CVE-2007-5380). The session management functionality allowed the     'session_id' to be set in the URL (CVE-2007-5380). BCC discovered that     the to_json() function does not properly sanitize input before     returning it to the user (CVE-2007-3227).
  Impact :

    Unauthenticated remote attackers could exploit these vulnerabilities to     determine the existence of files or to read the contents of arbitrary     XML files; conduct session fixation attacks and gain unauthorized     access; and to execute arbitrary HTML and script code in a user's     browser session in context of an affected site by enticing a user to     browse a specially crafted URL.
  Workaround :

    There is no known workaround at this time.

远程主机上的 Web 服务器似乎为支持基于 URL 的会话的 Ruby on Rails 版本。未经身份验证的远程攻击者可能会利用此问题获取经身份验证的会话。 

请注意，起初认为 Ruby on Rails 版本 1.2.4 会解决此问题，但在首先实例化 CgiRequest 时，其会话固定逻辑仅对第一个请求起作用。

遠端主機上的 web 伺服器似乎是支援 URL 型工作階段的 Ruby on Rails 版本。未經驗證的遠端攻擊者可以利用此問題取得經過驗證的工作階段。 

請注意，Ruby on Rails 版本 1.2.4 原先應要解決此問題，但其工作階段固定邏輯只能在 CgiRequest 首度具現化時用於第一個要求。

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have Security Update 2007-009 applied. 

This update contains several security fixes for a large number of programs.

Malicious users could specify their session-ID in the URL and could gain access to an authenticated session that way (CVE-2007-5380).

The remote server is running the Ruby on Rails web application.
This version of Rails is reported to be vulnerable to a number of flaws.  It is reported that a remote attacker can perform man-in-the-middle attacks and gain user credentials.  It is also reported that there is a content-parsing flaw in the XML handler that would allow an attacker to either gain unauthorized access to data or cause the application to fail.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
28333	Ruby on Rails Multiple Method Session Fixation	Nessus	Web Servers	2007/11/28	2022/4/11	medium
28333	Ruby on Rails の複数のメソッドセッションの固定	Nessus	Web Servers	2007/11/28	2022/4/11	medium
43378	GLSA-200912-02 : Ruby on Rails: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2009/12/22	2021/1/6	high
28217	GLSA-200711-17 : Ruby on Rails: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2007/11/15	2021/1/6	medium
28333	Ruby on Rails 多种方法会话固定	Nessus	Web Servers	2007/11/28	2022/4/11	medium
28333	Ruby on Rails 多個方法工作階段固定	Nessus	Web Servers	2007/11/28	2022/4/11	medium
29723	Mac OS X Multiple Vulnerabilities (Security Update 2007-009)	Nessus	MacOS X Local Security Checks	2007/12/18	2024/5/28	critical
28371	openSUSE 10 Security Update : rubygem-actionpack (rubygem-actionpack-4754)	Nessus	SuSE Local Security Checks	2007/11/30	2021/1/14	medium
4248	Ruby on Rails < 1.2.5 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	2007/10/17	2019/3/6	medium

検出

プラグインの検索

medium

medium

high

medium

medium

medium

critical

medium

medium