The host is running Ruby on Rails, which is prone to Authentication Bypass Vulnerability.

Successful exploitation will allow attacker to bypass authentication by providing an invalid username with an empty password and gain unauthorized access to the system. Impact Level: Application

Apply the security patches http://github.com/rails/rails/commit/056ddbdcfb07f0b5c7e6ed8a35f6c3b55b4ab489 ***** NOTE: Ignore this warning, if above mentioned patch is manually applied. *****

This Flaw is caused During login process, the digest authentication functionality (http_authentication.rb) returns a 'nil' instead of 'false' when the provided username is not found and then proceeds to verify this value against the provided password.

Ruby on Rails version 2.3.2 and prior

• http://secunia.com/advisories/35702
• http://weblog.rubyonrails.org/2009/6/3/security-problem-with-authenticate_with_http_digest
• http://www.vupen.com/english/advisories/2009/1802

---

Updated on 2015-03-25