Skip to content

Commit e67c83e

Browse files
author
Brent Cook
committed
Land rapid7#8119, Updated rails_secret_deserialization to add '.' cookie regex
2 parents ea4ca7e + 59c7de6 commit e67c83e

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

modules/exploits/multi/http/rails_secret_deserialization.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -235,7 +235,7 @@ def exploit
235235
'method' => datastore['HTTP_METHOD'],
236236
}, 25)
237237
if res && !res.get_cookies.empty?
238-
match = res.get_cookies.match(/([_A-Za-z0-9]+)=([A-Za-z0-9%]*)--([0-9A-Fa-f]+);/)
238+
match = res.get_cookies.match(/([._A-Za-z0-9]+)=([A-Za-z0-9%]*)--([0-9A-Fa-f]+);/)
239239
end
240240

241241
if match

0 commit comments

Comments
 (0)