Ruby on Rails Multiple Method Session Fixation

#!/usr/bin/env python3
# verify_rails_session_fixation.py
# Detect likely exposure to Rails session fixation covered by Nessus plugin 28333.
# Exit codes: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN, 3 USAGE/ERROR

import os
import re
import sys
from pathlib import Path

USAGE = "Usage: python3 verify_rails_session_fixation.py /path/to/rails_app"


def parse_version_tuple(v):
    parts = re.findall(r"\d+", v)
    if not parts:
        return None
    nums = [int(x) for x in parts[:3]]
    while len(nums) < 3:
        nums.append(0)
    return tuple(nums)


def find_rails_version(app):
    # 1) Gemfile.lock
    lock = app / "Gemfile.lock"
    if lock.exists():
        text = lock.read_text(errors="ignore")
        m = re.search(r"^\s{4}rails \(([^)]+)\)", text, re.M)
        if m:
            return m.group(1).strip(), "Gemfile.lock"

    # 2) vendor/rails/railties/lib/rails/version.rb or VERSION.yml
    candidates = [
        app / "vendor" / "rails" / "railties" / "lib" / "rails" / "version.rb",
        app / "vendor" / "rails" / "railties" / "lib" / "rails" / "version.rb",
        app / "vendor" / "rails" / "VERSION.yml",
        app / "vendor" / "rails" / "version.rb",
    ]
    for c in candidates:
        if c.exists():
            text = c.read_text(errors="ignore")
            m = re.search(r"VERSION\s*=\s*['\"]([^'\"]+)['\"]", text)
            if m:
                return m.group(1).strip(), str(c.relative_to(app))
            m = re.search(r"([0-9]+\.[0-9]+\.[0-9]+)", text)
            if m:
                return m.group(1).strip(), str(c.relative_to(app))

    # 3) config/environment.rb RAILS_GEM_VERSION
    envrb = app / "config" / "environment.rb"
    if envrb.exists():
        text = envrb.read_text(errors="ignore")
        m = re.search(r"RAILS_GEM_VERSION\s*=\s*['\"]([^'\"]+)['\"]", text)
        if m:
            return m.group(1).strip(), "config/environment.rb"

    return None, None


def detect_cookie_only(app):
    paths = [
        app / "config" / "environment.rb",
        app / "config" / "initializers" / "session_store.rb",
    ]
    patterns_true = [
        r"session_options\s*\[\s*:cookie_only\s*\]\s*=\s*true",
        r"session_options\s*\[\s*:cookie_session_id_only\s*\]\s*=\s*true",
    ]
    patterns_false = [
        r"session_options\s*\[\s*:cookie_only\s*\]\s*=\s*false",
        r"session_options\s*\[\s*:cookie_session_id_only\s*\]\s*=\s*false",
    ]

    found_files = []
    for p in paths:
        if p.exists():
            text = p.read_text(errors="ignore")
            found_files.append(str(p.relative_to(app)))
            for pat in patterns_true:
                if re.search(pat, text):
                    return True, found_files
            for pat in patterns_false:
                if re.search(pat, text):
                    return False, found_files
    return None, found_files


def main():
    if len(sys.argv) != 2:
        print("UNKNOWN - " + USAGE)
        sys.exit(3)

    app = Path(sys.argv[1]).resolve()
    if not app.exists() or not app.is_dir():
        print(f"UNKNOWN - path not found or not a directory: {app}")
        sys.exit(3)

    version_str, source = find_rails_version(app)
    if not version_str:
        print("UNKNOWN - could not determine Rails version from Gemfile.lock, vendored Rails, or config/environment.rb")
        sys.exit(2)

    vt = parse_version_tuple(version_str)
    if not vt:
        print(f"UNKNOWN - unable to parse Rails version: {version_str}")
        sys.exit(2)

    cookie_only, checked = detect_cookie_only(app)

    # Logic aligned to plugin 28333 / Rails 1.2.6 guidance.
    if vt < (1, 2, 6):
        print(f"VULNERABLE - Rails {version_str} detected via {source}; versions earlier than 1.2.6 fall in scope for session fixation / incomplete fix")
        sys.exit(1)

    if vt >= (1, 2, 6) and cookie_only is True:
        checked_desc = ", ".join(checked) if checked else "config not inspected"
        print(f"PATCHED - Rails {version_str} via {source}; cookie-only session enforcement detected in {checked_desc}")
        sys.exit(0)

    if vt >= (1, 2, 6) and cookie_only is False:
        checked_desc = ", ".join(checked) if checked else "config not inspected"
        print(f"UNKNOWN - Rails {version_str} via {source}; explicit non-cookie-only session setting found in {checked_desc}. Review manually against legacy session handling.")
        sys.exit(2)

    checked_desc = ", ".join(checked) if checked else "no relevant config files found"
    print(f"UNKNOWN - Rails {version_str} via {source}; no explicit cookie-only setting found ({checked_desc}). Manual review required.")
    sys.exit(2)


if __name__ == "__main__":
    main()