Devise weak password - Vulnerability Database

Devise weak password

Description

Devise is a flexible authentication solution for Rails based on Warden.

The application uses weak credentials that can be easily guessed through automated attacks. Invicti successfully authenticated to this page using common or predictable username and password combinations. Weak passwords include short strings, dictionary words, default credentials, common patterns, or passwords derived from usernames. These credentials are vulnerable to brute force and dictionary attacks that systematically test common password combinations.

Remediation

Implement and enforce a strong password policy with the following requirements:

1. Configure Devise password validation to require minimum password complexity (at least 12 characters, including uppercase, lowercase, numbers, and special characters)
2. Add the following to your User model to strengthen password requirements:

class User < ApplicationRecord
  devise :database_authenticatable, :registerable,
         :recoverable, :rememberable, :validatable

  validates :password, 
    length: { minimum: 12 },
    format: { 
      with: /\A(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&])/,
      message: "must include uppercase, lowercase, number, and special character"
    },
    if: :password_required?
end

3. Implement password strength checking using gems like strong_password or zxcvbn
4. Reject commonly used passwords by checking against known weak password lists
5. Enforce password rotation policies for sensitive accounts
6. Consider implementing multi-factor authentication (MFA) using Devise extensions like devise-two-factor
7. Monitor and alert on multiple failed authentication attempts to detect brute force attacks