We used an automated penetration testing service provider to scan our Rails web app, and came up with some vulnerabilities that we managed to fix most. Now after doing another round of testing we ended up with one vulnerability stating that the session strength is bad meaning that the session token is predictable and exhibits low randomness which exposes the app to session prediction attacks. We're using ruby 2.5.3p105, Rails 5.2.2, Devise 4.5.0, and serving the app from Heroku. We use CookieStore for session storage. Could this really be caused by the CSPRNG used by ruby (either the one provided by OpenSSL or /dev/urandom) not providing enough entropy during the test run? And what we can possibly do to increase randomness of the generated session keys for that failed test to pass?
Are session keys generated by Rails really immune to prediction attacks
Viewed 112
1 Answers
When using the CookieStore, the value is not a random session key, but rather a predictably-shaped value containing the server-encrypted (and signed) contents of the session.
If a tool (or human) is mistaking it for a random secret, it may indeed look less than fully random. It's not supposed to be. But it's also not predictable without breaking AES256.
Related