github.com/OWASP/railsgoat
Submitted 6/8/2026, 11:45:28 PM · Status: ok
Risk grade
F
100 / 100
Findings
204
7 critical48 high133 medium16 low0 info0 on CISA KEV0ATT&CK
Showing 204 of 204 findings
Findings
- Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserializationgrype
- net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated inputNet::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the server without validation or escaping. If this string is derived fro…trivy
- Net::IMAP implements Internet Message Access Protocol (IMAP) client fu ...Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments to commands are vulnerable to a CRLF Injection / IMAP Command injection via Symbol arguments passed to IMAP commands. This issu…trivy
- Rack::Session is a session management implementation for Rack. From 2. ...Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Session::Cookie incorrectly handles decryption failures when configured with secrets:. If cookie decryption fails, the implementation falls back to a default decoder instead of reject…trivy
- Rails: Active Storage: Active Storage (Rails): Arbitrary file access via path traversal in blob keysActive Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key…trivy
- rails: Active Storage: Unintended file deletion via crafted blob keysActive Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#delete_prefixed` passes blob keys directly to `Dir.glob` without escaping glob metacharacters. If a blob key contains …trivy
- ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injectionRuby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used …trivy
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Addressable has a Regular Expression Denial of Service in Addressable templatesgrype
- ERB has an @_init deserialization guard bypass via def_module / def_method / def_classgrype
- net-imap vulnerable to STARTTLS stripping via invalid response timinggrype
- Nokogiri CSS selector tokenizer has regular expression backtrackinggrype
- Nokogiri CSS selector tokenizer has regular expression backtrackinggrype
- Nokogiri CSS selector tokenizer has regular expression backtrackinggrype
- Nokogiri CSS selector tokenizer has regular expression backtrackinggrype
- Nokogiri CSS selector tokenizer has regular expression backtrackinggrype
- Nokogiri CSS selector tokenizer has regular expression backtrackinggrype
- Nokogiri CSS selector tokenizer has regular expression backtrackinggrype
- Nokogiri CSS selector tokenizer has regular expression backtrackinggrype
- Nokogiri CSS selector tokenizer has regular expression backtrackinggrype
- Rack has a Directory Traversal via Rack:Directorygrype
- Rack has quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding headergrype
- Rack::Static prefix matching can expose unintended files under the static rootgrype
- Rack's multipart header parsing allows Denial of Service via escape-heavy quoted parametersgrype
- Rack's multipart parsing without Content-Length header allows unbounded chunked file uploadsgrype
- Rails Active Storage has possible Path Traversal in DiskServicegrype
- Ruby JSON has a format string injection vulnerabilitygrype
- Allowing user input to `send_file` allows a malicious user to potentially read arbitrary files from the server. Avoid accepting user input in `send_file` or normalize with `File.basename(...)`semgrep/tmp/scan-psc_e739447e816185bf5ae1c11fa720722e/repo/app/controllers/benefit_forms_controller.rb:13
- Checks for dangerous permitted attributes that can lead to mass assignment vulnerabilities. Query parameters allowed using permit and attr_accessible are checked for allowance of dangerous attributesChecks for dangerous permitted attributes that can lead to mass assignment vulnerabilities. Query parameters allowed using permit and attr_accessible are checked for allowance of dangerous attributes admin, banned, role, and account_id. Also checks for usages of params.permit!, w…semgrep/tmp/scan-psc_e739447e816185bf5ae1c11fa720722e/repo/app/controllers/users_controller.rb:55
- Checks for unsafe deserialization. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object_load can cause remote code execution. Loading user iChecks for unsafe deserialization. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object_load can cause remote code execution. Loading user input with MARSHAL or CSV can potentially be dangerous. Use JSON in a secure fash…semgrep/tmp/scan-psc_e739447e816185bf5ae1c11fa720722e/repo/app/controllers/password_resets_controller.rb:6
- Detected controller which does not enable cross-site request forgery protections using 'protect_from_forgery'. Add 'protect_from_forgery :with => :exception' to your controller class.semgrep/tmp/scan-psc_e739447e816185bf5ae1c11fa720722e/repo/app/controllers/application_controller.rb:2
- Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injectioDetected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized quer…semgrep/tmp/scan-psc_e739447e816185bf5ae1c11fa720722e/repo/app/controllers/users_controller.rb:29
- Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controFound user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to reflection functionality. Do not call symbol conversion on user-…semgrep/tmp/scan-psc_e739447e816185bf5ae1c11fa720722e/repo/app/controllers/api/v1/mobile_controller.rb:10
- Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controFound user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to reflection functionality. Do not call symbol conversion on user-…semgrep/tmp/scan-psc_e739447e816185bf5ae1c11fa720722e/repo/app/controllers/benefit_forms_controller.rb:12
- Found user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controFound user-controllable input to Ruby reflection functionality. This allows a remote user to influence runtime behavior, up to and including arbitrary remote code execution. Do not provide user-controllable input to reflection functionality. Do not call symbol conversion on user-…semgrep/tmp/scan-psc_e739447e816185bf5ae1c11fa720722e/repo/app/controllers/api/v1/mobile_controller.rb:17
- Generic API Key detectedsemgrep/tmp/scan-psc_e739447e816185bf5ae1c11fa720722e/repo/app/assets/javascripts/bootstrap-image-gallery-main.js:61
- 'apt-get' missing '--no-install-recommends''apt-get' install should use '--no-install-recommends' to minimize image size.trivyDockerfile:2
- 'apt-get' missing '--no-install-recommends''apt-get' install should use '--no-install-recommends' to minimize image size.trivyopenshift-configs/Dockerfile:2
- addressable: Addressable: Denial of Service via crafted URI templatesAddressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 to before 2.9.0, within the URI template implementation in Addressable, two classes of URI template generate regular expressions vulnerable to catastrophic b…trivy
- erb: ERB: Arbitrary code execution via deserialization bypassERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution when an ERB object is reconstructed via `Marshal.load` (deserialization). Howeve…trivy
- github.com/bcrypt-ruby/bcrypt-ruby: bcrypt-ruby (JRuby): Weakened password hashing due to integer overflowbcrypt-ruby is a Ruby binding for the OpenBSD bcrypt() password hashing algorithm. Prior to version 3.1.22, an integer overflow in the Java BCrypt implementation for JRuby can cause zero iterations in the strengthening loop. Impacted applications must be setting the cost to 31 t…trivy
- github.com/rack/rack: Rack: Information disclosure via incorrect static file serving prefix checkRack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static determines whether a request should be served as a static file using a simple string prefix check. When configured with URL prefixes such as "/css", it matches any request path …trivy
- Image user should not be 'root'Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.trivyDockerfile:0
- Image user should not be 'root'Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.trivyopenshift-configs/Dockerfile:0
- Net::IMAP implements Internet Message Access Protocol (IMAP) client fu ...Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issue has been patched in…trivy
- Nokogiri CSS selector tokenizer has regular expression backtracking## Summary Nokogiri's CSS selector tokenizer contains regular expressions whose construction may result in exponential regex backtracking on adversarial selectors. Three ReDoS vectors are addressed in this release: 1. String-literal tokenization on certain unterminated quoted-s…trivy
- Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections## Impact Puma is vulnerable to source IP spoofing when set_remote_address proxy_protocol: :v1 is enabled and persistent connections are used. PROXY protocol v1 is a connection-level protocol. Support was added to Puma in v5.5.0. A proxy sends one PROXY header at the beginning …trivy
- Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion## Impact PROXY protocol support for Puma was added in version 5.5.0. When PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer. It waits for "\r\n" to determine whether a PROXY v1 line is present. If an attacker opens a TCP connection and con…trivy
- rack: Rack: Denial of Service via crafted multipart/form-data requestsRack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack::Multipart::Parser#handle_mime_head parses quoted multipart parameters such as Content-Disposition: form-data; name="..." using repeated String#index searches …trivy
- rack: Rack: Denial of Service via unbounded multipart file uploadRack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser only wraps the request body in a BoundedIO when CONTENT_LENGTH is present. When a multipart/form-data request is sent without a Content-Length header, such as with HT…trivy
- Rails: Active Storage: Rails Active Storage: Denial of Service via unbounded Range headerActive Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage's proxy delivery mode, the proxy controller loads the entire requested byte range into memory before sendi…trivy
- Rails: Active Support: Active Support: Denial of Service via large scientific notation stringsActive Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Support number helpers accept strings containing scientific notation (e.g. `1e10000`), which `BigDecimal` expands …trivy
- ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responsesNet::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, Net::IMAP::ResponseReader has quadratic time complexity when reading large responses containing many string literals. A hostile server can send …trivy
- rubygem-rack: Rack Directory Traversal via Rack:DirectoryRack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory`’s path check used a string prefix match on the expanded path. A request like `/../root_example/` can escape the configured root if the target path starts with the root stri…trivy
This report is public.