Re: Perl Store-able objects
Guido Brugnara <[email protected]> Wed, 29 Mar 2017 21:01:16 +0200 (CEST)
| Newsgroups | gmane.comp.web.mason.user |
|---|---|
| Message-ID | <[email protected]> |
--===============4860300644523422257== Content-Type: multipart/alternative; boundary="----=_Part_1682_356526117.1490814076571" ------=_Part_1682_356526117.1490814076571 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit ----- Il 29-mar-17, alle 16:22, Hiram Gibbard <[email protected]> ha scritto: > Anyone have any feed back on what might be expected from me to address the fact > that mason is using Perl storable objects? > On Tue, Jan 31, 2017 at 11:05 AM, Hiram Gibbard < [email protected] > wrote: >> Hi All, This may not be a Mason issue, but I have a security report stating the >> following: >> "Your app no longer use any of the Perl Storable Object cookies (cn, dn, >> changetoken) to keep state or perform authentication actions. However, the >> underlying Perl Mason application framework will still process the data in >> these cookies as Storable objects if they are included in user requests. As a >> result, it is still possible to trigger exploitation." >> Remediation: Do not process any cookies in user requests as Perl Storable >> objects. >> Looking for any guidance, clarity, or theories on the statement (high level of >> just where to look or what is it I might look for in the code). This >> application was written a long time ago by someone else, and I'm just trying to >> keep it running. On the Internet I do not find any trace of this notification in order to understand what is meant by " Perl Storable Object cookies ". What is the source of the alert ? ___ gdo ------=_Part_1682_356526117.1490814076571 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable <html><body><div style=3D"font-family: arial, helvetica, sans-serif; font-s= ize: 10pt; color: #000000"><div><span id=3D"zwchr" data-marker=3D"__DIVIDER= __">----- Il 29-mar-17, alle 16:22, Hiram Gibbard <[email protected]>= ; ha scritto:<br></span></div><div data-marker=3D"__QUOTED_TEXT__"><blockqu= ote style=3D"border-left: 2px solid #1010FF; margin-left: 5px; padding-left= : 5px; color: #000; font-weight: normal; font-style: normal; text-decoratio= n: none; font-family: Helvetica,Arial,sans-serif; font-size: 12pt;" data-mc= e-style=3D"border-left: 2px solid #1010FF; margin-left: 5px; padding-left: = 5px; color: #000; font-weight: normal; font-style: normal; text-decoration:= none; font-family: Helvetica,Arial,sans-serif; font-size: 12pt;"><div dir= =3D"ltr">Anyone have any feed back on what might be expected from me to add= ress the fact that mason is using Perl storable objects?</div><div class=3D= "gmail_extra"><br><div class=3D"gmail_quote">On Tue, Jan 31, 2017 at 11:05 = AM, Hiram Gibbard <span dir=3D"ltr"><<a href=3D"mailto:[email protected]= m" target=3D"_blank" data-mce-href=3D"mailto:[email protected]">hgibbard@g= mail.com</a>></span> wrote:<br><blockquote class=3D"gmail_quote" style= =3D"margin: 0 0 0 .8ex; border-left: 1px #ccc solid; padding-left: 1ex;" da= ta-mce-style=3D"margin: 0 0 0 .8ex; border-left: 1px #ccc solid; padding-le= ft: 1ex;"><div dir=3D"ltr">Hi All, This may not be a Mason issue, but I hav= e a security report stating the following:<br><div><span style=3D"font-size= : 11pt; font-family: calibri,sans-serif; color: black;" data-mce-style=3D"f= ont-size: 11pt; font-family: calibri,sans-serif; color: black;">"Your app n= o longer use any of the Perl Storable Object cookies (cn, dn, changetoken) = to keep state or perform authentication actions. However, the underly= ing Perl Mason application framework will still process the data in these c= ookies as Storable objects if they are included in user requests. As = a result, it is still possible to trigger exploitation."</span></div><div><= p class=3D"MsoNormal"><b><span style=3D"color: black;" data-mce-style=3D"co= lor: black;">Remediation: </span></b><span style=3D"color: blac= k;" data-mce-style=3D"color: black;">Do not process any cookies in user req= uests as Perl Storable objects.</span></p><p class=3D"MsoNormal"><span data= -mce-style=3D"color: #000000;" style=3D"color: #000000;" color=3D"#000000">= Looking for any guidance, clarity, or theories on the statement (high = level of just where to look or what is it I might look for in the code). Th= is application was written a long time ago by someone else, and I'm ju= st trying to keep it running.</span></p></div></div></blockquote></div></di= v></blockquote><div><br></div><div><span id=3D"result_box" class=3D"" lang= =3D"en"><span class=3D"">On the Internet</span> <span class=3D"">I do not f= ind</span> any<span> trace of</span> <span class=3D"">this notification in = order to understand <span>what is meant by "<span style=3D"font-size: 11pt;= font-family: calibri,sans-serif; color: black;" data-mce-style=3D"font-siz= e: 11pt; font-family: calibri,sans-serif; color: black;">Perl Storable Obje= ct cookies</span>".<br></span></span></span> <br></div><div><span id=3D"res= ult_box" class=3D"short_text" lang=3D"en"><span>What is the</span> <span>so= urce</span> <span class=3D"">of the alert</span><span class=3D"">?<br></spa= n></span><span id=3D"result_box" class=3D"" lang=3D"en"><span class=3D""></= span></span></div><div><span class=3D"short_text" lang=3D"en"><span class= =3D"">___<br data-mce-bogus=3D"1"></span></span></div><div><span class=3D"s= hort_text" lang=3D"en"><span class=3D"">gdo<br><br data-mce-bogus=3D"1"></s= pan></span></div></div></div></body></html> ------=_Part_1682_356526117.1490814076571-- --===============4860300644523422257== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot --===============4860300644523422257== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Mason-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/mason-users --===============4860300644523422257==--