@@ -19,14 +19,15 @@ def initialize(info={})
19
19
This module attempts to identify Ruby on Rails instances vulnerable to
20
20
an arbitrary object instantiation flaw in the JSON request processor.
21
21
} ,
22
- 'Author' => [
22
+ 'Author' =>
23
+ [
23
24
'jjarmoc' , # scanner module
24
25
'hdm' # CVE-2013-0156 scanner, basis of this technique.
25
- ] ,
26
+ ] ,
26
27
'License' => MSF_LICENSE ,
27
28
'References' =>
28
29
[
29
- [ 'CVE' , '2013-0333' ] ,
30
+ [ 'CVE' , '2013-0333' ]
30
31
]
31
32
) )
32
33
@@ -38,11 +39,11 @@ def initialize(info={})
38
39
39
40
def send_probe ( pdata )
40
41
res = send_request_cgi ( {
41
- 'uri' => datastore [ 'TARGETURI' ] ,
42
+ 'uri' => normalize_uri ( datastore [ 'TARGETURI' ] ) ,
42
43
'method' => datastore [ 'HTTP_METHOD' ] ,
43
44
'ctype' => 'application/json' ,
44
45
'data' => pdata
45
- } , 25 )
46
+ } )
46
47
end
47
48
48
49
def run_host ( ip )
@@ -58,8 +59,7 @@ def run_host(ip)
58
59
end
59
60
60
61
if res1 . code . to_s =~ /^[5]/
61
- print_error ( "#{ rhost } :#{ rport } The server replied with #{ res1 . code } for our initial JSON request" )
62
- print_error ( "\t \t Double check TARGETURI and HTTP_METHOD" )
62
+ vprint_error ( "#{ rhost } :#{ rport } The server replied with #{ res1 . code } for our initial JSON request, double check TARGETURI and HTTP_METHOD" )
63
63
return
64
64
end
65
65
@@ -94,7 +94,7 @@ def run_host(ip)
94
94
} )
95
95
else
96
96
# Otherwise we're not likely vulnerable.
97
- vprint_status ( "#{ rhost } :#{ rport } is not likely to be vulnerable or TARGETURI must be set" )
97
+ vprint_status ( "#{ rhost } :#{ rport } is not likely to be vulnerable or TARGETURI & HTTP_METHOD must be set" )
98
98
end
99
99
end
100
100
0 commit comments