https://github.com/bararchy/vuln-app
just testing for STAR
https://github.com/bararchy/vuln-app
Last synced: 3 months ago
JSON representation
just testing for STAR
- Host: GitHub
- URL: https://github.com/bararchy/vuln-app
- Owner: bararchy
- Created: 2025-10-17T16:17:38.000Z (10 months ago)
- Default Branch: main
- Last Pushed: 2025-11-18T11:36:11.000Z (9 months ago)
- Last Synced: 2025-11-18T13:20:22.307Z (9 months ago)
- Language: Ruby
- Size: 296 KB
- Stars: 0
- Watchers: 0
- Forks: 0
- Open Issues: 13
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# DVRA - Damn Vulnerable Ruby Application
A deliberately vulnerable Rails application designed for testing SAST (Static Application Security Testing) tools.
## 🚀 Quick Start
### Running with Docker Compose (Recommended)
1. **Build and start the application:**
```bash
docker-compose up --build
```
2. **Access the application:**
Open your browser to [http://localhost:3000](http://localhost:3000)
3. **Stop the application:**
```bash
docker-compose down
```
### Running with Docker
1. **Build the Docker image:**
```bash
docker build -t vuln-rails-app .
```
2. **Run the container:**
```bash
docker run -p 3000:3000 -v $(pwd):/app vuln-rails-app
```
### Running Commands Inside the Container
```bash
# Run migrations
docker-compose exec web bundle exec rails db:migrate
# Open Rails console
docker-compose exec web bundle exec rails console
# Run tests
docker-compose exec web bundle exec rails test
# Run security scanners
docker-compose exec web ./run_scanners.sh
# Access bash shell
docker-compose exec web bash
```
## 🐛 Vulnerabilities
This application contains the following intentional security vulnerabilities:
| Location | Vulnerability | Exploitable at Runtime? |
|----------|---------------|------------------------|
| `config/initializers/secret_token.rb:1` | **Vuln 1:** Hardcoded secret (Google API Key) | ✅ via `/config` |
| `app/controllers/users_controller.rb:20` | **Vuln 2:** Unscoped Find/Read IDOR | ✅ via `/users/:id` |
| `app/controllers/users_controller.rb:29` | **Vuln 3:** Mass Assignment | ✅ via `POST /users` |
| `app/controllers/sessions_controller.rb:4` | **Vuln 4:** SQLi via parent class method with hash reassignment | ✅ via `POST /sessions` |
| `app/controllers/posts_controller.rb:21` | **Vuln 5:** *Maybe* Unscoped find IDOR? | ✅ via `/posts/:id` |
| `app/controllers/posts_controller.rb:69` | **Vuln 6:** sanitize_sql_array SQLi false positive (MEU-1468) | ✅ via `PUT /posts/:id?meu=1` |
| `app/controllers/posts_controller.rb:65` | **Vuln 7:** UnscopedFind Delete IDOR with parent class accessor and hash reassignment | ✅ via `DELETE /posts/:id` |
| `app/controllers/application_controller.rb:27` | **Vuln 8:** Cookie tampering ATO | ✅ Cookie-based |
| `app/controllers/posts_controller.rb:7` | **Vuln 9:** XSS via html_safe | ✅ via `POST /posts/render_html` |
| `app/controllers/posts_controller.rb:81` | **Vuln 10:** SQLi via callee interpolation | ✅ via `PUT /posts/:id` |
| `app/models/user.rb:2` | **Vuln 11:** Plaintext password storage | ✅ via `/users/:id/credentials` |
| `app/controllers/application_controller.rb:11` | **Vuln 12:** Information disclosure - `/config` endpoint exposes secrets | ✅ via `/config` |
| `config/initializers/cors.rb` | **Vuln 13:** Overly permissive CORS (`origins '*'`) | 🔍 SAST-only |
| `config/initializers/content_security_policy.rb` | **Vuln 14:** CSP disabled/permissive (`unsafe-inline`, `unsafe-eval`) | 🔍 SAST-only |
| `app/controllers/application_controller.rb:5` | **Vuln 15:** CSRF protection disabled | ✅ via `POST /users/:id/transfer_ownership` |
## 🔍 Running Security Scans
Execute all security scanners:
```bash
./run_scanners.sh
```
## 🧪 Running Tests
Run the API endpoint tests:
```bash
./test_api_endpoints.sh
```
This will test all API endpoints including authentication, CRUD operations, and verify that the intentional vulnerabilities are present.
## 📊 SAST Tool Comparison
| Vuln ID | Vuln Example | Semgrep | Semgrep Pro | Corgea Blast | Brakeman 7.1.0 |
|---------|--------------|---------|-------------|--------------|----------------|
| 1 | Secret | Detected | Detected | **Not** Detected (incorrectly marked as FP) | Detected |
| 2 | Read IDOR | **Not** Detected* | **Not** Detected* | Partially Detected** | **Not** Detected |
| 3 | Mass Assignment | **Not** Detected | **Not** Detected | **Not** Detected | Detected |
| 4 | Complex SQLi | **Not** Detected | **Not** Detected | Detected | Detected*** |
| 5 | UnscopedFind IDOR | Detected | Detected | Detected | **Not** Detected |
| 6 | SQLi sanitize_sql_array FP (MEU-1468) | **Not** Detected | **Not** Detected | Detected | **Not** Detected |
| 7 | Delete IDOR | **Not** Detected | **Not** Detected | Detected | **Not** Detected |
| 8 | Cookie Tampering | Detected | Detected | Detected | **Not** Detected |
| 9 | XSS | Detected | Detected | **Not** Detected | **Not** Detected |
| 10 | Callee Interpolated SQLi | **Not** Detected | **Not** Detected | Detected | **Not** Detected |
| 11 | Plaintext PW Storage | **Not** Detected | **Not** Detected | Detected | Detected |
| | **Total Findings** | 11 | 11 | 17 | 4 |
| | **Detection Rate** | 36% | 36% | 73% | 27% |
| | **FP Rate** | TODO | TODO | TODO | TODO |
### Notes
\* Meraki Semgrep rule will detect this finding
\*\* Reflects non-deterministic behavior. Noted examples were suppressed as false positives during some executions.
\*\*\* String interpolation detected, user input is not a factor (this will lead to high number of false positives)
### Honorable Mention
- [dawnscanner](https://github.com/thesp0nge/dawnscanner) failed to find *any* vulnerabilities in this application.
## ⚠️ Warning
**This application is intentionally vulnerable. Do NOT deploy this in a production environment or expose it to the internet.**