Re: Perl Store-able objects

--===============4695245763559871281==
Content-Type: multipart/alternative; boundary=f4030435c11cb7fdc0054be3ea6b

--f4030435c11cb7fdc0054be3ea6b
Content-Type: text/plain; charset=UTF-8

Hiram,

Mason itself does not use cookies. It does use Storable, indirectly,
through the Cache::Cache library, but only for internal data, not for any
data that is sent to or read from the client. It does not have any special
handling for client input named cn, dn, or changetoken.

However, Mason is a framework which people build applications on top of. It
may well be that your application has the problem described, but that would
be in your application code, not in Mason.

If your code is accepting user input and feeding it to Storable, I agree
that wouldn't be a good thing, and you should probably change it.

- Perrin

On Wed, Mar 29, 2017 at 10:22 AM, Hiram Gibbard <[email protected]> wrote:

> Anyone have any feed back on what might be expected from me to address the
> fact that mason is using Perl storable objects?
>
> On Tue, Jan 31, 2017 at 11:05 AM, Hiram Gibbard <[email protected]>
> wrote:
>
>> Hi All, This may not be a Mason issue, but I have a security report
>> stating the following:
>>
>> "Your app no longer use any of the Perl Storable Object cookies (cn, dn,
>> changetoken) to keep state or perform authentication actions.  However, the
>> underlying Perl Mason application framework will still process the data in
>> these cookies as Storable objects if they are included in user requests.
>> As a result, it is still possible to trigger exploitation."
>>
>> *Remediation:   *Do not process any cookies in user requests as Perl
>> Storable objects.
>>
>>
>> Looking for any guidance, clarity, or theories on the statement (high
>> level of just where to look or what is it I might look for in the code).
>> This application was written a long time ago by someone else, and I'm just
>> trying to keep it running.
>>
>>
>> Thanks in advance,
>>
>>
>>
>> --
>> Hiram Gibbard
>> [email protected]
>> http://hiramgibbard.com
>>
>>
>
>
> --
> Hiram Gibbard
> [email protected]
> http://hiramgibbard.com
>
>
> ------------------------------------------------------------
> ------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> Mason-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/mason-users
>
>

--f4030435c11cb7fdc0054be3ea6b
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hiram,<div><br></div><div>Mason itself does not use cookie=
s. It does use Storable, indirectly, through the Cache::Cache library, but =
only for internal data, not for any data that is sent to or read from the c=
lient. It does not have any special handling for client input named cn, dn,=
 or changetoken.</div><div><br></div><div>However, Mason is a framework whi=
ch people build applications on top of. It may well be that your applicatio=
n has the problem described, but that would be in your application code, no=
t in Mason.</div><div><br></div><div>If your code is accepting user input a=
nd feeding it to Storable, I agree that wouldn&#39;t be a good thing, and y=
ou should probably change it.</div><div><br></div><div>- Perrin</div></div>=
<div class=3D"gmail_extra"><br><div class=3D"gmail_quote">On Wed, Mar 29, 2=
017 at 10:22 AM, Hiram Gibbard <span dir=3D"ltr">&lt;<a href=3D"mailto:hgib=
[email protected]" target=3D"_blank">[email protected]</a>&gt;</span> wrote:<=
br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left=
:1px #ccc solid;padding-left:1ex"><div dir=3D"ltr">Anyone have any feed bac=
k on what might be expected from me to address the fact that mason is using=
 Perl storable objects?</div><div class=3D"HOEnZb"><div class=3D"h5"><div c=
lass=3D"gmail_extra"><br><div class=3D"gmail_quote">On Tue, Jan 31, 2017 at=
 11:05 AM, Hiram Gibbard <span dir=3D"ltr">&lt;<a href=3D"mailto:hgibbard@g=
mail.com" target=3D"_blank">[email protected]</a>&gt;</span> wrote:<br><bl=
ockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #=
ccc solid;padding-left:1ex"><div dir=3D"ltr">Hi All, This may not be a Maso=
n issue, but I have a security report stating the following:<div><br></div>=
<div><span style=3D"font-size:11pt;font-family:calibri,sans-serif;color:bla=
ck">&quot;Your app no longer use any of the Perl Storable Object
cookies (cn, dn, changetoken) to keep state or perform authentication
actions.=C2=A0 However, the underlying Perl Mason application framework wil=
l
still process the data in these cookies as Storable objects if they are
included in user requests.=C2=A0 As a result, it is still possible to trigg=
er
exploitation.&quot;</span></div><div><font color=3D"#000000" face=3D"calibr=
i, sans-serif"><span style=3D"font-size:14.6667px"><br></span></font></div>=
<div><p class=3D"MsoNormal"><b><span style=3D"color:black">Remediation:=C2=
=A0 =C2=A0</span></b><span style=3D"color:black">Do not process any cookies=
 in user requests as Perl
Storable objects.<span></span></span></p><p class=3D"MsoNormal"><span style=
=3D"color:black"><br></span></p><p class=3D"MsoNormal"><font color=3D"#0000=
00">Looking for any guidance, clarity, or theories on the=C2=A0statement (h=
igh level of just where to look or what is it I might look for in the code)=
. This application=C2=A0was written a long time ago by someone else, and I&=
#39;m just trying to keep it running.</font></p><p class=3D"MsoNormal"><fon=
t color=3D"#000000"><br></font></p><p class=3D"MsoNormal"><font color=3D"#0=
00000">Thanks in advance,</font></p><span class=3D"m_8064954993676311328HOE=
nZb"><font color=3D"#888888"><p class=3D"MsoNormal"><font color=3D"#000000"=
><br></font></p><div><br></div>-- <br><div class=3D"m_8064954993676311328m_=
-8384477306014231388gmail_signature"><div dir=3D"ltr"><div>Hiram Gibbard<br=
><a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]=
</a></div><div><a href=3D"http://hiramgibbard.com" target=3D"_blank">http:/=
/hiramgibbard.com</a></div><div><br><div style=3D"display:inline"></div></d=
iv></div></div>
</font></span></div></div>
</blockquote></div><br><br clear=3D"all"><div><br></div>-- <br><div class=
=3D"m_8064954993676311328gmail_signature" data-smartmail=3D"gmail_signature=
"><div dir=3D"ltr"><div>Hiram Gibbard<br><a href=3D"mailto:[email protected]=
om" target=3D"_blank">[email protected]</a></div><div><a href=3D"http://hi=
ramgibbard.com" target=3D"_blank">http://hiramgibbard.com</a></div><div><br=
><div style=3D"display:inline"></div></div></div></div>
</div>
</div></div><br>------------------------------<wbr>------------------------=
------<wbr>------------------<br>
Check out the vibrant tech community on one of the world&#39;s most<br>
engaging tech sites, Slashdot.org! <a href=3D"http://sdm.link/slashdot" rel=
=3D"noreferrer" target=3D"_blank">http://sdm.link/slashdot</a><br>_________=
_____________________<wbr>_________________<br>
Mason-users mailing list<br>
<a href=3D"mailto:[email protected]">[email protected]=
ceforge.<wbr>net</a><br>
<a href=3D"https://lists.sourceforge.net/lists/listinfo/mason-users" rel=3D=
"noreferrer" target=3D"_blank">https://lists.sourceforge.net/<wbr>lists/lis=
tinfo/mason-users</a><br>
<br></blockquote></div><br></div>

--f4030435c11cb7fdc0054be3ea6b--


--===============4695245763559871281==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
--===============4695245763559871281==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Mason-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mason-users

--===============4695245763559871281==--