Ruby on Rails Action Pack XML Parameter Parsing Object Injection RCE

This repository contains a proof-of-concept exploit for CVE-2013-0156, a critical remote code execution vulnerability in Ruby on Rails (versions 2.x and 3.x). The exploit is implemented in a single Ruby script (rails_rce.rb) and is designed to be compatible with modern Ruby versions, removing dependencies on the Ronin framework. The script constructs a malicious XML payload containing a YAML-encoded Ruby object that triggers arbitrary code execution when deserialized by a vulnerable Rails server. The user supplies the target URL and the Ruby code to execute. The exploit sends a POST request with the crafted payload to the target, attempting to execute the supplied code on the server. The README.md provides usage instructions and legal disclaimers. No hardcoded endpoints are present; the target is specified at runtime. The repository is structured simply, with one exploit script and a README, and is intended for educational and authorized penetration testing use only.

This repository contains a single Metasploit exploit module targeting Ruby on Rails applications vulnerable to secret-based session deserialization (CVE-2013-0156). The exploit requires knowledge of the application's secret_token (Rails 2/3) or secret_key_base (Rails 4), which is often found in the file 'config/initializers/secret_token.rb'. The module crafts a malicious session cookie containing a serialized Ruby object with embedded attacker-controlled code. This cookie is signed or encrypted using the known secret and sent to the target application via HTTP. Upon deserialization, the payload is executed, resulting in remote code execution (RCE) on the server. The module supports both Rails 3 and Rails 4, with configurable options for the HTTP method, target URI, cookie name, digest type, and salts. The main attack vector is network-based, exploiting the HTTP interface of the Rails application. The code is operational and can be used to achieve RCE if the required secret is known.

This repository contains a single Metasploit module: 'rails_xml_yaml_code_exec.rb', which exploits CVE-2013-0156, a remote code execution vulnerability in the XML request processor of Ruby on Rails (versions 2.x and 3.x). The exploit works by sending a specially crafted XML request containing a malicious YAML payload that is deserialized by the Rails application, leading to arbitrary Ruby code execution. The module allows the attacker to specify the HTTP method (GET, POST, PUT) and the URI path to the vulnerable endpoint. The payload is encoded and embedded in the YAML, which is then wrapped in XML and sent to the target over HTTP. The exploit is weaponized, as it is part of the Metasploit framework and supports customizable payloads. The only fingerprintable endpoint is the URI path (default '/'), which must point to a vulnerable Rails application. The module is highly configurable and can be used to gain remote code execution on affected systems.