Rails-doubletap-RCE

Rails-doubletap-exploit 利用路径遍历（CVE-2019-5418）和 Ruby 对象反序列化（CVE-2019-5420）在 Rails 5.2.2 上实现远程代码执行（RCE） 技术分析 ： CVE-2019-5418 - https://github.com/mpgn/CVE-2019-5418 CVE-2019-5420 - https://hackerone.com/reports/473888 安全公告 ： CVE-2019-5418 -...

CVE-2019-5420

CVE-2019-5420 CVE-2019-5420 Ruby on Rails Solo con fines educativos. Consulte Referencia para los detalles. Entorno Ruby: 2.6.0p0 Rails: 5.2.2 Ejecución root@kitploit: $ docker run --name cve-2019-5420 --rm -p 3000:3000 knqyf263/cve-2019-5420 Explotación Ejecute touch /tmp/rce root@kitploit: $ cu...

cve-2019-5420

CVE-2019-5420 Esto es parte de Cved: una herramienta para gestionar contenedores Docker vulnerables. Cved: https://github.com/git-rep-src/cved Fuente de la imagen: https://github.com/cved-sources/cve-2019-5420 Autor de la imagen: https://github.com/knqyf263/CVE-2019-5420...

CVE-2019-5420

CVE-2019-5420 用于学习的 poc...

CVE-2019-5420-PoC

CVE-2019-5420-PoC 为 PentesterLab 编写了这个 如果你来自 PentesterLab，请不要作弊，自己学习会好得多。 希望对某些人有用，如果不行，至少未来对我也许有用 : 不错的 argparse 代码，一个不赖的 PoC 用法 root@kitploit: usage: script.py -h --appname APPNAME --cookie COOKIE --modify KEY VALUE CVE-2019-5420 options: -h, --help show this help message and exit --appname...

CVE-2019-5420.rb

CVE-2019-5420.rb 使用 Ruby 编写的 POC 漏洞利用程序 从目标应用获取你的 Cookies 并填入脚本，然后通过 ruby ./exploit.rb 运行。...

CVE-2019-5420-RCE

此存储库没有 README。...

Exploit for Command Injection in Rubyonrails Rails

CVE-2019-5420 A vulnerability can allow an attacker to guess t...

Exploit for Command Injection in Rubyonrails Rails

CVE-2019-5420.rb POC Explo...

SUSE: Security Advisory (SUSE-SU-2020:3147-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Exploit for Command Injection in Rubyonrails Rails

CVE-2019-5420 Ruby-on-Rails offers three different environmen...

Ruby on Rails Active Storage Insecure Deserialization (CVE-2019-5420)

An insecure deserialization vulnerability exists in Ruby on Rails' ActiveStorage component. Successful exploitation of this vulnerability could allow a remote authenticated attacker with at least author-level privileges to execute arbitrary code on the affected system...

Discourse < 2.3.0.beta5 Multiple Vulnerabilities

Discourse is prone to multiple vulnerabilities in Ruby on Rails. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Fedora 30 : 1:rubygem-actionmailer / 1:rubygem-actionpack / etc (2019-1cfe24db5c)

Update Ruby on Rails to 5.2.3. Fixes CVE-2019-5418 CVE-2019-5419 CVE-2019-5420. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...

Fedora Update for rubygem-activemodel FEDORA-2019-1cfe24db5c

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for rubygem-actioncable FEDORA-2019-1cfe24db5c

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for rubygem-rails FEDORA-2019-1cfe24db5c

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ruby On Rails - DoubleTap Development Mode secret_key_base Remote Code Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Ruby On Rails DoubleTap Development Mode secretkeybase Vulnerability', 'Description' = %q This module exploits a vulnerability in Ruby on Rails. ...

Ruby On Rails DoubleTap Development Mode secret_key_base Remote Code Execution Exploit

This Metasploit module exploits a vulnerability in Ruby on Rails. In development mode, a Rails application would use its name as the secretkeybase, and can be easily extracted by visiting an invalid resource for a path. As a result, this allows a remote user to create and deliver a signed...

Ruby On Rails DoubleTap Development Mode secret_key_base Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Ruby On Rails DoubleTap Development Mode secretkeybase Vulnerability', 'Description' = %q This module exploits a vulnerability in Ruby on Rails. ...