Ruby on Rails XML Processor YAML Deserialization Code Execution
This module exploits a remote code execution vulnerability in the XML request processor of the Ruby on Rails application framework. This vulnerability allows an attacker to instantiate a remote object, which in turn can be used to execute any ruby code remotely in the context of the application. This module has been tested across multiple versions of RoR 3.x and RoR 2.x The technique used by this module requires the target to be running a fairly recent version of Ruby 1.9 (since 2011 or so). Applications using Ruby 1.8 may still be exploitable using the init_with() method, but this has not been demonstrated.
Module Name
exploit/multi/http/rails_xml_yaml_code_exec
Authors
- charliesome
- espes
- lian
- hdm <x [at] hdm.io>
References
Targets
- Automatic
Platforms
- ruby
Architectures
- ruby
Reliability
Development
Module Options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/multi/http/rails_xml_yaml_code_exec
msf exploit(rails_xml_yaml_code_exec) > show targets
...targets...
msf exploit(rails_xml_yaml_code_exec) > set TARGET <target-id>
msf exploit(rails_xml_yaml_code_exec) > show options
...show and set options...
msf exploit(rails_xml_yaml_code_exec) > exploit
Related Vulnerabilities
- FreeBSD: rubygem-rails -- multiple vulnerabilities (Multiple CVEs)
- SUSE Linux Security Vulnerability: CVE-2013-0156
- DSA-2604-1 rails -- insufficient input validation
- OS X update for Podcast Producer Server (CVE-2013-0156)
- OS X update for Profile Manager (CVE-2013-0156)
- RHSA-2013:0153: Ruby on Rails security update
- RHSA-2013:0155: Ruby on Rails security update
- OS X update for Wiki Server (CVE-2013-0156)
- OS X update for Note (CVE-2013-0156)
- Alpine Linux: CVE-2013-0156: Vulnerability in rails < 2.3.15 allows remote denial of service
- RHSA-2013:0154: Ruby on Rails security update
- OS X update for Ruby (CVE-2013-0156)
- Ruby on Rails XML Processor YAML Deserialization