CVE-2016-2098

Public PoC / Exploit (2)

Exploit-DBRuby on Rails ActionPack Inline ERB - Code Execution (Metasploit)TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.

Weaknesses (CWE)

CWE-20

Affected Products (73)

debian · debian_linuxvulnerable

rubyonrails · railsvulnerable

...and 23 more

References (20)

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00057.html

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00080.html

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00083.html

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00086.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00006.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html

http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released/

PatchVendor Advisory

http://www.debian.org/security/2016/dsa-3509

http://www.securityfocus.com/bid/83725

http://www.securitytracker.com/id/1035122

https://groups.google.com/forum/message/raw?msg=rubyonrails-security/ly-IH-fxr_Q/WLoOhcMZIAAJ

https://www.exploit-db.com/exploits/40086/