Ruby: Add InsecureDownload query

[hmac]

This query finds cases where a potentially unsafe file is downloaded
over an unsecured connection.

[github-actions]

QHelp previews:

ruby/ql/src/queries/security/cwe-829/InsecureDownload.qhelp

Download of sensitive file through insecure connection

Downloading executeables or other sensitive files over an unencrypted connection can leave a server open to man-in-the-middle attacks (MITM). Such an attack can allow an attacker to insert arbitrary content into the downloaded file, and in the worst case, allow the attacker to execute arbitrary code on the vulnerable system.

Recommendation

Use a secure transfer protocol when downloading executables or other sensitive files.

Example

In this example, a server downloads a shell script from a remote URL and then executes the script.

require "net/http"

script = Net::HTTP.new("http://mydownload.example.org").get("/myscript.sh").body
system(script)

The HTTP protocol is vulnerable to MITM, and thus an attacker could potentially replace the downloaded shell script with arbitrary code, which gives the attacker complete control over the system.

The issue has been fixed in the example below by replacing the HTTP protocol with the HTTPS protocol.

require "net/http"

script = Net::HTTP.new("https://mydownload.example.org").get("/myscript.sh").body
system(script)

References

• Wikipedia: Man-in-the-middle attack
• Common Weakness Enumeration: CWE-829.

[github-actions]

QHelp previews:

ruby/ql/src/queries/security/cwe-829/InsecureDownload.qhelp

Download of sensitive file through insecure connection

Downloading executeables or other sensitive files over an unencrypted connection can leave a server open to man-in-the-middle attacks (MITM). Such an attack can allow an attacker to insert arbitrary content into the downloaded file, and in the worst case, allow the attacker to execute arbitrary code on the vulnerable system.

Recommendation

Use a secure transfer protocol when downloading executables or other sensitive files.

Example

In this example, a server downloads a shell script from a remote URL and then executes the script.

require "net/http"

script = Net::HTTP.new("http://mydownload.example.org").get("/myscript.sh").body
system(script)

The HTTP protocol is vulnerable to MITM, and thus an attacker could potentially replace the downloaded shell script with arbitrary code, which gives the attacker complete control over the system.

The issue has been fixed in the example below by replacing the HTTP protocol with the HTTPS protocol.

require "net/http"

script = Net::HTTP.new("https://mydownload.example.org").get("/myscript.sh").body
system(script)

References

• Wikipedia: Man-in-the-middle attack
• Common Weakness Enumeration: CWE-829.

[github-actions]

QHelp previews:

ruby/ql/src/queries/security/cwe-829/InsecureDownload.qhelp

Download of sensitive file through insecure connection

Downloading executeables or other sensitive files over an unencrypted connection can leave a server open to man-in-the-middle attacks (MITM). Such an attack can allow an attacker to insert arbitrary content into the downloaded file, and in the worst case, allow the attacker to execute arbitrary code on the vulnerable system.

Recommendation

Use a secure transfer protocol when downloading executables or other sensitive files.

Example

In this example, a server downloads a shell script from a remote URL and then executes the script.

require "net/http"

script = Net::HTTP.new("http://mydownload.example.org").get("/myscript.sh").body
system(script)

The HTTP protocol is vulnerable to MITM, and thus an attacker could potentially replace the downloaded shell script with arbitrary code, which gives the attacker complete control over the system.

The issue has been fixed in the example below by replacing the HTTP protocol with the HTTPS protocol.

require "net/http"

script = Net::HTTP.new("https://mydownload.example.org").get("/myscript.sh").body
system(script)

References

• Wikipedia: Man-in-the-middle attack
• Common Weakness Enumeration: CWE-829.

[github-actions]

QHelp previews:

ruby/ql/src/queries/security/cwe-829/InsecureDownload.qhelp

Download of sensitive file through insecure connection

Downloading executeables or other sensitive files over an unencrypted connection can leave a server open to man-in-the-middle attacks (MITM). Such an attack can allow an attacker to insert arbitrary content into the downloaded file, and in the worst case, allow the attacker to execute arbitrary code on the vulnerable system.

Recommendation

Use a secure transfer protocol when downloading executables or other sensitive files.

Example

In this example, a server downloads a shell script from a remote URL and then executes the script.

require "net/http"

script = Net::HTTP.new("http://mydownload.example.org").get("/myscript.sh").body
system(script)

The HTTP protocol is vulnerable to MITM, and thus an attacker could potentially replace the downloaded shell script with arbitrary code, which gives the attacker complete control over the system.

The issue has been fixed in the example below by replacing the HTTP protocol with the HTTPS protocol.

require "net/http"

script = Net::HTTP.new("https://mydownload.example.org").get("/myscript.sh").body
system(script)

References

• Wikipedia: Man-in-the-middle attack
• Common Weakness Enumeration: CWE-829.

[github-actions]

QHelp previews:

ruby/ql/src/queries/security/cwe-829/InsecureDownload.qhelp

Download of sensitive file through insecure connection

Downloading executeables or other sensitive files over an unencrypted connection can leave a server open to man-in-the-middle attacks (MITM). Such an attack can allow an attacker to insert arbitrary content into the downloaded file, and in the worst case, allow the attacker to execute arbitrary code on the vulnerable system.

Recommendation

Use a secure transfer protocol when downloading executables or other sensitive files.

Example

In this example, a server downloads a shell script from a remote URL and then executes the script.

require "net/http"

script = Net::HTTP.new("http://mydownload.example.org").get("/myscript.sh").body
system(script)

The HTTP protocol is vulnerable to MITM, and thus an attacker could potentially replace the downloaded shell script with arbitrary code, which gives the attacker complete control over the system.

The issue has been fixed in the example below by replacing the HTTP protocol with the HTTPS protocol.

require "net/http"

script = Net::HTTP.new("https://mydownload.example.org").get("/myscript.sh").body
system(script)

References

• Wikipedia: Man-in-the-middle attack
• Common Weakness Enumeration: CWE-829.

[github-actions]

QHelp previews:

ruby/ql/src/queries/security/cwe-829/InsecureDownload.qhelp

Download of sensitive file through insecure connection

Downloading executeables or other sensitive files over an unencrypted connection can leave a server open to man-in-the-middle attacks (MITM). Such an attack can allow an attacker to insert arbitrary content into the downloaded file, and in the worst case, allow the attacker to execute arbitrary code on the vulnerable system.

Recommendation

Use a secure transfer protocol when downloading executables or other sensitive files.

Example

In this example, a server downloads a shell script from a remote URL and then executes the script.

require "net/http"

script = Net::HTTP.new("http://mydownload.example.org").get("/myscript.sh").body
system(script)

The HTTP protocol is vulnerable to MITM, and thus an attacker could potentially replace the downloaded shell script with arbitrary code, which gives the attacker complete control over the system.

The issue has been fixed in the example below by replacing the HTTP protocol with the HTTPS protocol.

require "net/http"

script = Net::HTTP.new("https://mydownload.example.org").get("/myscript.sh").body
system(script)

References

• Wikipedia: Man-in-the-middle attack
• Common Weakness Enumeration: CWE-829.

[alexrford]

Looks good, just some nitpicks and points I was unsure about. I've started another DCA run as the previous one seems to have failed.

[alexrford]

I've started another DCA run as the previous one seems to have failed.

Looks like this is due to an unrelated build failure, I think it may be fixed by a rebase or merge of main.