News for hackers. Stuff that matters.

A comment on Rails PoC exploits for CVE-2013-0156 and CVE-2013-0155.

Re:Rails PoC exploits for CVE-2013-0156 and CVE-2013-0155 by benmmurphy on Thursday January 10, 2013 @05:53AM (#5036348)
I think PoC might depend on ruby >=1.9.3 because ruby/hash:Foo syntax is a newish feature. Commit where it was introduced: https://github.com/ruby/ruby/commit/8cd2bf072180a9f733ac06db...

There are at least two YAML parsing libraries (psych/syck) and they both have different behaviours as well.

But a lot of rails 3.x apps are going to be running 1.9.3

[ Parent | on HN ]
Re:Rails PoC exploits for CVE-2013-0156 and CVE-2013-0155 by vinhboy on Thursday January 10, 2013 @06:50PM (#5040501)
Are you going to release your PoC. Curious to see it.
[ Parent | on HN ]
Re:Rails PoC exploits for CVE-2013-0156 and CVE-2013-0155 by benmmurphy on Friday January 11, 2013 @05:04PM (#5045338)
A modified version has already been released by someone else and I've saw this version in another blog post before it was pulled down.
[ Parent | on HN ]
Re:Rails PoC exploits for CVE-2013-0156 and CVE-2013-0155 by postmodern_mod3 on Friday January 11, 2013 @05:49PM (#5045521)
Charlie Somerville has already released his PoC. http://charlie.bz/blog/rails-3.2.10-remote-code-execution

You should release your PoC(s) as well.

[ Parent | on HN ]