RoR Database Configuration File Detected - Vulnerability Database

RoR Database Configuration File Detected

Description

Ruby on Rails applications store database credentials and connection settings in config/database.yml, which typically includes configurations for production, development, and test environments. This file contains sensitive information such as database hostnames, usernames, passwords, and database names. When this configuration file is accessible via web requests, it exposes critical infrastructure details that should remain confidential.

Remediation

Take the following steps to secure the database configuration file:

1. Restrict web server access: Ensure your web server configuration explicitly denies access to the config/ directory. For Apache, add the following to your .htaccess or virtual host configuration:

<Directory /path/to/rails/app/config>
  Require all denied
</Directory>

For Nginx, add:

location ~ ^/config/ {
  deny all;
  return 404;
}

2. Use environment variables: Store sensitive credentials in environment variables instead of committing them to database.yml. Reference them using ERB syntax:

production:
  adapter: postgresql
  database: myapp_production
  username: <%= ENV['DATABASE_USERNAME'] %>
  password: <%= ENV['DATABASE_PASSWORD'] %>
  host: <%= ENV['DATABASE_HOST'] %>

3. Verify file permissions: Ensure database.yml has restrictive permissions (600 or 640) and is owned by the application user.
4. Rotate credentials: If this file was exposed, immediately rotate all database passwords and review access logs for unauthorized activity.