logo

Database

Ruby Insufficiently Protected Credentials

Description

Detects insufficiently protected SMTP credentials in Ruby applications where email configuration settings may expose sensitive information. This vulnerability could allow attackers to obtain email server credentials if the configuration is not properly secured.

Weakness:

359 - Sensitive information in source code - Credentials

Category: Information Collection

Detection Strategy

    • Look for 'smtp_settings' method calls in Ruby code

    • Check if the SMTP settings configuration is in a potentially insecure context

    • Report a vulnerability when SMTP settings are configured without proper credential protection

    • Focus on email configuration blocks that might expose username, password or authentication details

Vulnerable code example

# Vulnerable: Hardcoded SMTP credentials directly in configuration
Rails.application.configure do
  config.action_mailer.smtp_settings = {
    address: "smtp.gmail.com",
    port: 587,
    user_name: "admin@example.com",  # Vulnerable: Hardcoded username
    password: "SuperSecretPassword123",  # Vulnerable: Hardcoded password
    authentication: :plain...

✅ Secure code example

Rails.application.configure do
  config.action_mailer.smtp_settings = {
    address: ENV.fetch('SMTP_ADDRESS', 'smtp.gmail.com'),
    port: ENV.fetch('SMTP_PORT', 587),
    user_name: ENV.fetch('SMTP_USERNAME'),  # Secure: Credentials from environment variables
    password: ENV.fetch('SMTP_PASSWORD'),   # Secure: Password not hardcoded
    authentication: :plain,
    enable_starttls_auto: true  # Added for enhanced transport security...