Ruby on Rails
A web framework for Ruby that favours convention.
Where It Sits
The small stack marks its layer. Beside it, each related technology links to its own page.
- App
- FrameworkRuby on Rails
- Web Server
- Runtime
- Containers
- OS
- Hypervisor
- Firmware
- Hardware
- Data
About
Ruby on Rails is a web framework for Ruby that favours convention over configuration, meaning apps follow set names and folders so they need little set-up. It runs on the Ruby runtime, served by Puma by default, and powers large applications such as GitLab. Its session cookie and, before Rails 7.0, its X-Runtime header often give it away.
How to Spot It
These are signs that a system runs Ruby on Rails, seen from outside without signing in, such as a response header, a cookie, a path or a default port. They help you find where it runs across your own estate. A version shown to the world also tells anyone scanning which flaws might apply, so it is worth hiding.
- Response header (before Rails 7.0)
X-Runtime: 0.123456- Cookie
_myapp_session- Page source
<meta name="csrf-param" content="authenticity_token" />
If It Has a Flaw
A flaw in Rails can reach every application built on it. Its history includes flaws in the framework itself that let attackers run code on the server, not only bugs in single apps.
A flaw exposes what runs on it and the data it reaches.
- Application
GitLab- Data
PostgreSQL
Redis
Well-Known Flaws
Each flaw has a CVE id, the unique number a publicly known vulnerability is given so that every advisory names the same flaw. The id links to the advisory, and the card says what the flaw let an attacker do and how far it reached because of where Ruby on Rails sits.
CVE-2013-0156 (opens in a new tab)2013
Rails XML Parameter Code Execution
Crafted XML request parameters let attackers run code on Rails applications.
Reach It was a flaw in the framework, so it reached every app on the affected versions.
Rivals
Rivals do the same job on the same layer, so a system usually runs one of them in any one place. A flaw in a rival does not reach Ruby on Rails.
Stacks and Code
Ruby on Rails is part of the common stacks below, and each stack's page shows who runs every layer. Its code arrives from the sources listed, and each source's page says how bad code could get in through it.
- In Common Stacks
- A Rails App on Puma
- Its Code Comes From
RubyGemsCI and Build Systems