Rails PoC exploits for CVE-2013-0156 and CVE-2013-0155

Posted by thibaut_barrere on Thursday January 10, 2013 @04:25AM
from the ronin-ruby.github.com dept.

( 4 comments | 29 points | on HN )

Re:Rails PoC exploits for CVE-2013-0156 and CVE-2013-0155 by benmmurphy on Thursday January 10, 2013 @05:53AM (#5036348)

I think PoC might depend on ruby >=1.9.3 because ruby/hash:Foo syntax is a newish feature. Commit where it was introduced: https://github.com/ruby/ruby/commit/8cd2bf072180a9f733ac06db...

There are at least two YAML parsing libraries (psych/syck) and they both have different behaviours as well.

But a lot of rails 3.x apps are going to be running 1.9.3

[ Parent | on HN ]

Re:Rails PoC exploits for CVE-2013-0156 and CVE-2013-0155 by vinhboy on Thursday January 10, 2013 @06:50PM (#5040501)

Are you going to release your PoC. Curious to see it.

[ Parent | on HN ]

Re:Rails PoC exploits for CVE-2013-0156 and CVE-2013-0155 by benmmurphy on Friday January 11, 2013 @05:04PM (#5045338)

A modified version has already been released by someone else and I've saw this version in another blog post before it was pulled down.

[ Parent | on HN ]

Re:Rails PoC exploits for CVE-2013-0156 and CVE-2013-0155 by postmodern_mod3 on Friday January 11, 2013 @05:49PM (#5045521)

You should release your PoC(s) as well.

[ Parent | on HN ]