module
Ruby on Rails Web Console (v2) Whitelist Bypass Code Execution
Disclosed | Created |
---|---|
Jun 16, 2015 | May 30, 2018 |
Disclosed
Jun 16, 2015
Created
May 30, 2018
Description
This module exploits an IP whitelist bypass vulnerability in the developer
web console included with Ruby on Rails 4.0.x and 4.1.x. This module will also
achieve code execution on Rails 4.2.x if the attack is launched from a
whitelisted IP range.
web console included with Ruby on Rails 4.0.x and 4.1.x. This module will also
achieve code execution on Rails 4.2.x if the attack is launched from a
whitelisted IP range.
Authors
joernchen joernchen@phenoelit.de
Ben Murphy benmmurphy@gmail.com
hdm x@hdm.io
Ben Murphy benmmurphy@gmail.com
hdm x@hdm.io
Platform
Ruby
Architectures
ruby
References
Module Options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.