Published: 07/04/2016 Updated: 08/08/2019

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 7.3 | Impact Score: 3.4 | Exploitability Score: 3.9

VMScore: 758

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Action Pack in Ruby on Rails prior to 3.2.22.2, 4.x prior to 4.1.14.2, and 4.2.x prior to 4.2.5.2 allows remote malicious users to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.

Vulnerable Product	Search on Vulmon	Subscribe to Product
debian debian linux 8.0
rubyonrails rails 4.2.4
rubyonrails rails 4.2.3
rubyonrails rails 4.2.1
rubyonrails rails 4.2.0
rubyonrails rails 4.0.0
rubyonrails rails 4.1.9
rubyonrails rails 4.1.3
rubyonrails rails 4.1.2
rubyonrails rails 4.1.12
rubyonrails rails 4.1.10
rubyonrails rails 4.1.0
rubyonrails rails 4.0.6
rubyonrails rails 4.0.5
rubyonrails rails 4.0.1
rubyonrails ruby on rails
rubyonrails rails 4.2.5
rubyonrails rails 4.1.5
rubyonrails rails 4.1.4
rubyonrails rails 4.1.14
rubyonrails rails 4.1.13
rubyonrails rails 4.0.10
rubyonrails ruby on rails 4.1.14.1
rubyonrails rails 4.2.5.1
rubyonrails rails 4.1.7
rubyonrails rails 4.1.6
rubyonrails rails 4.1.1
rubyonrails rails 4.0.8
rubyonrails rails 4.0.7
rubyonrails rails 4.0.3
rubyonrails rails 4.0.2
rubyonrails rails 4.2.2
rubyonrails rails 4.1.8
rubyonrails rails 4.1.7.1
rubyonrails rails 4.0.9
rubyonrails rails 4.0.4

Two vulnerabilities have been discovered in Rails, a web application framework written in Ruby Both vulnerabilities affect Action Pack, which handles the web requests for Rails CVE-2016-2097 Crafted requests to Action View, one of the components of Action Pack, might result in rendering files from arbitrary locations, including files ...

## # This module requires Metasploit: metasploitcom/download # Current source: githubcom/rapid7/metasploit-framework ## require 'msf/core' class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient def initialize(info = {}) super(update_info(info, 'Name' ...

CVE-2016-2098 Action Pack in Ruby on Rails before 32222, 4x before 41142, and 42x before 4252 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method Class Input Validation Error Credits Tobias Kraze from makandra and joernchen of Phenoelit Usage Please do the necessary edits on the code to be

CVE-2016-2098 POC

CVE-2016-2098 CVE-2016-2098 POC

Ruby On Rails unrestricted render() exploit

CVE-2016-2098 Action Pack in Ruby on Rails before 32222, 4x before 41142, and 42x before 4252 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method Resources cvemitreorg/cgi-bin/cvenamecgi?name=CVE-2016-2098 Usage To use this exploit script, you need three parameters 1 The web

Proof of concept CVE-2016-2098

A Proof of Concept of vulnerability: CVE-2016-2098 University project created by @alejandro-marting where we can check the vulnerability 2096 Using: rails 4251 view has a vulnerable code app/views/poc/render1htmlerb ![] (githubcom/Alejandro-MartinG/rails-PoC-CVE-2016-2098/blob/master/app/assets/images/Captura%20de%20pantalla%20de%202017-01-15%2009:50:23png) ##E

CVE-2016-2098 simple POC written in bash

CVE-2016-2098 Action Pack in Ruby on Rails before 32222, 4x before 41142, and 42x before 4252 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method cvemitreorg/cgi-bin/cvenamecgi?name=CVE-2016-2098 Usage git clone githubcom/its-arun/CVE-2016-2098git cd CVE-2016-2098 /bin

Remote code execution vulnerability in Ruby-on-Rails when using render on user-supplied data.

CVE-2016-2098 Remote code execution vulnerability in Ruby-on-Rails when using render on user-supplied data Explanation: This issue comes from the usage of the render method on user-supplied data The method render is usually used to render a page from a template, but render method also allows developers to render plain text (plaintext) and even inline code (inline) render fun

This exploit is remote code execution vulnerability in Ruby-on-Rails when using render on user-supplied data

CVE-2016-2098-my-first-exploit This exploit is remote code execution vulnerability in Ruby-on-Rails when using render on user-supplied data It's written in python3, and remember to install the requests library here is the command pip3 install requests

A PoC of CVE-2016-2098 (rails4.2.5.1 / view render)

A PoC of CVE-2016-2098 rails 4251 view has a vulnerable code app/views/poc/render1htmlerb following command will cause remote code execution $ curl '<your_host>:3000/poc/render1?template\[inline\]=<%25%3d`sleep+5`%25>'

CVE-2016-2098 - POC of RCE Ruby on Rails: Improper Input Validation (CVE-2016-2098) in bash. Remote attackers can execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.

CVE-2016-2098 Action Pack in Ruby on Rails before 32222, 4x before 41142, and 42x before 4252 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method (RCE) nvdnistgov/vuln/detail/CVE-2016-2098 Use git clone githubcom/Debalinax64/CVE-2016-2098git cd CVE-2016-2098 /bin/bash ru

Script that exploits the vulnerability that allows remote code execution in Ruby 2.3.8 with CVE-2016-2098

Ruby-on-Rails-ActionPack-Inline-ERB-Remote-Code-Execution Script that exploits the vulnerability that allows remote code execution in Ruby 238 with CVE-2016-2098 Usage /Ruby_On_Rails_ActionPack_Inline_ERB-Remote_Code_Executionpy [-h] --target-host TARGET_HOST --port PORT [--target-uri TARGET_URI] [--target-param TARGET_PARAM] --payload PAYLOAD

CWE-20 http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released/http://www.securitytracker.com/id/1035122 https://groups.google.com/forum/message/raw?msg=rubyonrails-security/ly-IH-fxr_Q/WLoOhcMZIAAJ http://www.debian.org/security/2016/dsa-3509 http://www.securityfocus.com/bid/83725 http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00080.html http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00086.html http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00083.html http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00057.html http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00006.html https://www.exploit-db.com/exploits/40086/https://nvd.nist.gov https://www.debian.org/security/./dsa-3509 https://www.exploit-db.com/exploits/40086/https://github.com/Shakun8/CVE-2016-2098

CVE-2016-2098

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect