Ruby on Rails - JSON Processor YAML Deserialization Code Execution (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'Ruby on Rails JSON Processor YAML...

Ruby On Rails XML Processor YAML Deserialization Code Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'Ruby on Rails XML Processor YAML...

CVE-2012-3424

The decodecredentials method in actionpack/lib/actioncontroller/metal/httpauthentication.rb in Ruby on Rails 3.x before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts Digest Authentication strings to symbols, which allows remote attackers to cause a denial of service by leveraging...

Ruby on Rails http_authentication.rb Nil凭据绕过认证漏洞

BUGTRAQ ID: 35579 Ruby on Rails是一个新的Web应用程序框架，构建在Ruby语言之上。 Ruby on Rails的actionpack/lib/actioncontroller/httpauthentication.rb文件中的 validatedigestresponse函数在处理nil凭据时存在错误，如果没有找到用户返回的是nil，而正确的行为是返回 false。远程攻击者发送空的认证凭据就可以绕过HTTP认证获得非授权访问。 David Heinemeier Hansson Ruby on Rails 2.3.2 厂商补丁： David...