Metasploit Rails 3 Remote Code Execution Hours Away

Re:Metasploit Rails 3 Remote Code Execution Hours Away by gautamc on Thursday January 10, 2013 @12:34AM (#5035641)

On a patched server I see a Hash::DisallowedType (Disallowed type attribute: "yaml") exception raised by activesupport.

As a simpler test-case, I modified the rails_rce.rb ( for CVE-2013-0156 )and passed a simpler yaml that creates a Time object:

yaml = %{ --- !ruby/object:Time {} } xml = %{ <?xml version="1.0" encoding="UTF-8"?> <#{param} type="yaml">#{yaml}</#{param}> }.strip

print_info "POSTing #{code} to #{url} ..."

response = http_request( :method => :post, :url => url, :headers => {:content_type => 'text/xml'}, :body => xml )

This way a vulnerable server's log file shows something like give below(ie. the Time object was actually created from the yaml):

Started POST "/users/sign_in" for 127.0.0.1 at 2013-01-10 00:26:40 -0500 Processing by Devise::SessionsController#create as / Parameters: {"secret"=>1969-12-31 19:00:00 -0500}

A patched server raises a Hash::DisallowedType (Disallowed type attribute: "yaml") exception.

[ Parent | on HN ]

Re:Metasploit Rails 3 Remote Code Execution Hours Away by kapilkale on Thursday January 10, 2013 @12:48AM (#5035681)

I'm unable to reproduce- not sure why. Seeing no parameters. I'm getting:

  Started POST "/user/sign_in" for 127.0.0.1 at 2013-01-09 21:40:56 -0800
  Processing by UsersController#sign_in as */*

If I comment out the patch, I see:

  Parameters: {"secret"=>1969-12-31 16:00:00 -0800}

So I suspect others may not see the same exception... I'm using ActiveSupport 3.0.3, fyi.

[ Parent | on HN ]

Re:Metasploit Rails 3 Remote Code Execution Hours Away by gautamc on Thursday January 10, 2013 @01:10AM (#5035747)

Yep. I see what you mean.

activesupport-3.2.11/lib/active_support/core_ext/hash/conversions.rb has a -- DISALLOWED_XML_TYPES = %w(symbol yaml) -- which is used by its def typecast_xml_value to raise the exception.

I don't see these lines of code in activesupport-3.0.3/lib/active_support/core_ext/hash/conversions.rb

In my case I could upgrade to 3.2.11.

In your case, I am guessing you added the lines of code that disable xml and yaml parameter parsing to an initializer (or application.rb). This way, activesupport simply wouldn't try to convert the parameter value in question into a ruby object.

[ Parent | on HN ]

Re:Metasploit Rails 3 Remote Code Execution Hours Away by kapilkale on Thursday January 10, 2013 @01:31AM (#5035805)

Right. Thanks!

[ Parent | on HN ]

Re:Metasploit Rails 3 Remote Code Execution Hours Away by j_mac on Thursday January 17, 2013 @12:59PM (#5073978)

Thanks for posting this, you gave me the bits I needed to make a simple test I could use to verify the patch, without needing the metasploit stuff. (on rails 2.3, I don't get the disallowedType error, but I can verify in the logs that the patch works)

http://www.railsperformance.com/2013/01/simple-test-for-rail...

[ Parent | on HN ]