Exploit Code, Metasploit Module Out for Ruby on Rails Flaws

threatpost.com 10 Jan '13, 3pm

Exploit Code, Metasploit Module Out for Ruby on Rails Flaws

Just two days after the disclosure of a string of serious vulnerabilities in Ruby on Rails, researchers have released proof-of-concept exploit code for a couple of the flaws and the team at Metasploit have released a module for the penetration testing framework that exploit one of the bugs, as well. The CVE-2013-0156 vulnerabilities in Ruby on Rails enable an attacker to take a variety of unwanted actions on vulnerable applications, including executing arbitrary code, accessing data on a backend database and bypassing the authentication system. Researchers have warned about the seriousness of these bugs and recommended that users update their installations immediately. And that was before the exploit code and Metasploit module were published. Now, the urgency to move to a fixed version of Ruby on Rails has ratcheted up a few notches. Adam O'Donnell of Sourcefire said in an...

Full article: http://threatpost.com/en_us/blogs/exploit-code-metasploit...

Tweets

@PointBlankIre » 12 Jan '13, 12pm
Serious threat.. "If you are running Rails code, stop what you are doing and upgrade your Rails environment right now" [link]
@jsvd » 11 Jan '13, 12pm
RT @nuvan: Exploit Code, Metasploit Module Out for Ruby on Rails Flaws [link] /cc @blackthorne
@nuvan » 11 Jan '13, 12pm
Exploit Code, Metasploit Module Out for Ruby on Rails Flaws [link] /cc @blackthorne
@hackermk » 11 Jan '13, 9am
RT @eEye: Exploit Code, Metasploit Module Out for Ruby on Rails Flaws [link] #netsec #infosec #security
@hermandijkhuis » 11 Jan '13, 9am
#Exploit #Code, Metasploit Module Out for #Ruby on #Rails Flaws [link] #kaspersky #threatpost
@BeyondTrust » 11 Jan '13, 9am
Exploit Code, Metasploit Module Out for Ruby on Rails Flaws [link] #netsec #infosec #security
@mayankthanawala » 11 Jan '13, 6am
RT @johnmarkos: If you run a Ruby on Rails app, make sure you fix this vulnerability in it. Update Rails or disable XML parsing. [link]
@johnmarkos » 11 Jan '13, 5am
If you run a Ruby on Rails app, make sure you fix this vulnerability in it. Update Rails or disable XML parsing. [link]
@h3hes » 11 Jan '13, 12am
RT @alienvault: Proof-of-concept exploit code and Metasploit module published Ruby on Rails flaws - [link]
@Melankh_ » 10 Jan '13, 10pm
“@threatpost: Proof-of-concept exploit code and Metasploit module published Ruby on Rails flaws - [link]” @_oTiMo_
@TrocarRogue » 10 Jan '13, 10pm
RT @maarten_g: Update those Ruby on Rails installations: [link]
@tvachon » 10 Jan '13, 8pm
"stop what you are doing and upgrade your Rails environment right now." [link]
@maarten_g » 10 Jan '13, 7pm
Update those Ruby on Rails installations: [link]
@bradshoop » 10 Jan '13, 6pm
RT @mcholste: Rails vuln [link] increases exploit pack hosting, Java 0day [link] makes kits effective. Get #SecurityOnion now!
@mcholste » 10 Jan '13, 6pm
Rails vuln [link] increases exploit pack hosting, Java 0day [link] makes kits effective. Get #SecurityOnion now!
@DominioHacker » 10 Jan '13, 4pm
Exploit Code, Metasploit Module Out for Ruby on Rails Flaws [link] via @threatpost @securityartwork
@Dennis_B_Bruijn » 10 Jan '13, 4pm
[link] #RoR #MetaSploit #Exploit #SQLInjection #RemoteCodeExecution #AuthenticationBypass
@C3cilioCP » 10 Jan '13, 4pm
RT @1nf0s3cpt: Exploit Code, Metasploit Module Out For Ruby On Rails Flaws: Just two days after the disclosure of a string of s... [link]
@rails_rt_ja » 10 Jan '13, 4pm
RT @0x009AD6_810: RoR の Exploit Code が Metasploit にも来てますな。> Exploit Code, Metasploit Module Out for Ruby on Rails Flaws | threatpost [link]
@netsecured99 » 10 Jan '13, 3pm
RT @InfotechNews_2013Exploit Code, Metasploit Module Out for Ruby on Rails Flaws [link] [TPOST]: Exploit Code, Metasplo...
@InfotechNews_ » 10 Jan '13, 3pm
Exploit Code, Metasploit Module Out for Ruby on Rails Flaws [link] [TPOST]
@CcureIT » 10 Jan '13, 3pm
Exploit Code, Metasploit Module Out for Ruby on Rails Flaws [link] #ccureit
@jcran » 10 Jan '13, 3pm
RT @briankrebs: RT @endpoint_secure: Exploit Code, Metasploit Module Out for Ruby on Rails Flaws [link]
@T_SDesignWorks » 10 Jan '13, 3pm
RT @blackd0t: Exploit Code, Metasploit Module Out for Ruby on Rails Flaws [link]
@0x009AD6_810 » 10 Jan '13, 3pm
RoR の Exploit Code が Metasploit にも来てますな。> Exploit Code, Metasploit Module Out for Ruby on Rails Flaws | threatpost [link]
@FrankyArthurWay » 10 Jan '13, 3pm
RT @binushacker: #Malicious #Threat Exploit Code, Metasploit Module Out for Ruby on Rails Flaws [link] #Virus #Malware
@starkeymagazine » 10 Jan '13, 3pm
#Infosec Exploit Code, Metasploit Module Out for Ruby on Rails Flaws [link] #News
@SecMash » 10 Jan '13, 3pm
#InfoSec Exploit Code, Metasploit Module Out for Ruby on Rails Flaws [link] #CyberSecurity
@briankrebs » 10 Jan '13, 3pm
RT @endpoint_secure: Exploit Code, Metasploit Module Out for Ruby on Rails Flaws [link]
@thinksnews » 10 Jan '13, 3pm
Exploit Code, Metasploit Module Out for Ruby on Rails Flaws: Just two days after the disclosure of... [link] #securitynews
@binushacker » 10 Jan '13, 3pm
#Malicious #Threat Exploit Code, Metasploit Module Out for Ruby on Rails Flaws [link] #Virus #Malware
@securitydigest » 10 Jan '13, 3pm
#security Exploit Code, Metasploit Module Out for Ruby on Rails Flaws: Just two days after the disclosur... [link] #online
@servermanagedit » 10 Jan '13, 3pm
RT @threatpost: Proof-of-concept exploit code and Metasploit module published Ruby on Rails flaws - [link]
@threatpost » 10 Jan '13, 3pm
Proof-of-concept exploit code and Metasploit module published Ruby on Rails flaws - [link]
@IT_securitynews » 10 Jan '13, 3pm
Exploit Code, Metasploit Module Out for Ruby on Rails Flaws: Just two days after the disclosure of a string of s... [link]
@InfoSecRSS » 10 Jan '13, 3pm
Exploit Code, Metasploit Module Out for Ruby on Rails Flaws: Just two days after the disclosure of a string of s... [link]
@TechL0G » 10 Jan '13, 3pm
Exploit Code, Metasploit Module Out for Ruby on Rails Flaws [link] | [link]
@igigis » 10 Jan '13, 3pm
Exploit Code, Metasploit Module Out for Ruby on Rails Flaws [link]
@Endpoint_Secure » 10 Jan '13, 3pm
Exploit Code, Metasploit Module Out for Ruby on Rails Flaws [link]
@SecurityPhresh » 10 Jan '13, 3pm
#Exploit Code, Metasploit Module Out For Ruby On Rails Flaws... [link]