POC详情： a3a83b905e1deaf473e47a80a922f2c774ab8686

来源
https://github.com/Eremiel/CVE-2019-5420
关联漏洞
标题： Ruby on Rails 安全特征问题漏洞 (CVE-2019-5420)
描述：Ruby on Rails是Rails团队的一套基于Ruby语言的开源Web应用框架。 Ruby on Rails中存在安全特征问题漏洞。远程攻击者可利用该漏洞在受影响的系统上执行任意代码。
介绍
# CVE-2019-5420

Ruby-on-Rails offers three different environments it can run in: development, test and production. You should obviously not have code running in development or test available on the internet but it (as always) happens (for example in staging environments).

Ruby-on-Rails uses “signed-sessions” to allow people to easily scale their applications. Over time, the way the sessions were handled changed. With 5.2.2, sessions are JSON encoded data that is protected using AES GCM (aes-256-gcm) by default.

CVE-2019–5420 is actually very simple. The key used to encrypt sessions can be guessed (or brute forced) in development mode as it is based on the name of the application. This issue can potentially be used to gain code execution (RCE) according to the advisory.

Simple pyton script exploits the above functionality.
文件快照

 [4.0K]  /data/pocs/a3a83b905e1deaf473e47a80a922f2c774ab8686
├── [1.1K]  cve-2019-5420.py
└── [ 844]  README.md

0 directories, 2 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。