CVE-2020-8163 PoC — Ruby on Rails 代码注入漏洞

Source

https://github.com/lucasallan/CVE-2020-8163

Associated Vulnerability

Title:Ruby on Rails 代码注入漏洞 (CVE-2020-8163)
Description:The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call to perform a RCE.

Description

CVE-2020-8163 - Remote code execution of user-provided local names in Rails

Readme

# CVE-2020-8163
CVE-2020-8163 - Remote code execution of user-provided local names in Rails

Remote code execution of user-provided local names in Rails < 5.0.1

There was a vulnerability in versions of Rails prior to 5.0.1 that would
allow an attacker who controlled the `locals` argument of a `render` call.

This vulnerability has been assigned the CVE identifier CVE-2020-8163.

Versions Affected:  rails < 5.0.1
Not affected:       Applications that do not allow users to control the names of locals.
Fixed Versions:     4.2.11.2

### Vulnerable app:

I've included a vulnerable app that can be used for testing purposes. The vulnerable endpoint is: `main/index`

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!