CVE-2016-2098 PoC — Ruby on Rails Action Pack 安全漏洞

Description

CVE-2016-2098 - POC of RCE Ruby on Rails: Improper Input Validation (CVE-2016-2098) in bash. Remote attackers can execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.

介绍

# CVE-2016-2098

Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method (RCE)

https://nvd.nist.gov/vuln/detail/CVE-2016-2098






# Use
git clone https://github.com/Debalinax64/CVE-2016-2098.git

cd CVE-2016-2098

/bin/bash ruby-on-rail-RCE.sh < website> <target_uri> < command>

Example: /bin/bash ruby-on-rail-RCE.sh "http://target.com" "pages?id" "pwd"

文件快照

备注