ruby-on-rails-framework-exceptions: Ruby on Rails Framework Exceptions

id: ruby-on-rails-framework-exceptions

info:
  name: Ruby on Rails Framework Exceptions
  author: geeknik
  severity: medium
  description: Detects suspicious Ruby on Rails exceptions that could indicate exploitation attempts
  reference:
    - http://edgeguides.rubyonrails.org/security.html
    - http://guides.rubyonrails.org/action_controller_overview.html
    - https://stackoverflow.com/questions/25892194/does-rails-come-with-a-not-authorized-exception
    - https://github.com/rails/rails/blob/master/actionpack/lib/action_dispatch/middleware/exception_wrapper.rb
  tags: file,logs,ruby,rails
file:
  - extensions:
      - all

    extractors:
      - type: regex
        name: exception
        part: body
        regex:
          - 'ActionController\:\:InvalidAuthenticityToken'
          - 'ActionController::InvalidCrossOriginRequest'
          - 'ActionController::MethodNotAllowed'
          - 'ActionController::BadRequest'
          - 'ActionController::ParameterMissing'
# digest: 4b0a00483046022100bb9e711f4d48a398212ba981e7fab0c7de159c515ebdb47d22230c562ef2fd140221008a433ebea90c2bed4fefb630f620a0feb1c037b5e68892b3acf19bcb9763c307:922c64590222798bb761d5b6d8e72950