Ruby on Rails Action View File Content Disclosure via Accept Header

This repository contains a single Metasploit auxiliary module (rails_doubletap_file_read.rb) that exploits a path traversal vulnerability (CVE-2019-5418) in Ruby on Rails versions <= 5.2.2. The module allows an attacker to read arbitrary files from the target server by sending a specially crafted HTTP GET request with a manipulated 'Accept' header. The attacker can specify the HTTP route to target, the depth of traversal, and the absolute path of the file to read (default: /etc/passwd). If successful, the contents of the file are retrieved and stored as loot in Metasploit. The module is operational and requires the attacker to know a valid route and file path on the vulnerable server. The code is written in Ruby and is designed to be used within the Metasploit framework.

This repository is a proof-of-concept (PoC) exploit for CVE-2019-5418, a file content disclosure vulnerability in Ruby on Rails (Action View). The repository contains a full Rails demo application (in the 'demo/' directory) configured to be vulnerable to this issue. The main exploit vector is the '/chybeta' HTTP endpoint, which renders files based on the 'render file:' pattern in the controller. By sending a specially crafted HTTP request with a manipulated Accept header (e.g., Accept: ../../../../../../../../../../etc/passwd{{), an attacker can force the application to disclose arbitrary files from the server's filesystem. The README.md provides a detailed technical analysis, PoC steps, and references to the vulnerability and its fix. The exploit does not provide a post-exploitation payload but demonstrates the ability to read sensitive files, which can lead to further compromise. The codebase is primarily Ruby (Rails), with supporting JavaScript and asset files typical of a Rails application.

This repository contains a working exploit for two critical vulnerabilities in Ruby on Rails 5.2.1/5.2.2: CVE-2019-5418 (File Content Disclosure) and CVE-2019-5420 (Deserialization RCE). The exploit is implemented in 'exploit.rb', which automates the attack chain: 1. It first checks if the target Rails application is vulnerable to CVE-2019-5418 by attempting to read /etc/passwd via a crafted Accept header. 2. If vulnerable, it retrieves sensitive files ('config/credentials.yml.enc' and 'config/master.key') using the same file disclosure technique. 3. It then decrypts the credentials to obtain the 'secret_key_base'. 4. Using this key, it crafts a malicious Ruby object payload that exploits CVE-2019-5420 by sending it to the '/rails/active_storage/disk/:encoded_key/test' endpoint, resulting in remote code execution. 5. The exploit supports both reflected command execution (output written to /tmp/result.txt and retrievable via file disclosure) and reverse shell payloads. The repository also includes a full Rails 5.2.1 demo application for testing, but the main exploit logic is in 'exploit.rb'. The attack is network-based and targets HTTP endpoints on the vulnerable Rails server. The exploit is operational and provides a reliable method for achieving RCE on unpatched Rails installations.