漏洞描述
Ruby on Rails是一款Web应用程序框架，构建在Ruby语言之上。Ruby on Rails序列化属性处理代码存在漏洞。Active Record中的 serialize helper允许开发者把各种序列化对象存储到数据库中的BLOB栏中。对象使用YAML序列化和反序列化，如果开发者允许用户直接提供此属性值，攻击者可提交特制请求使应用程序反序列化任意YAML，可导致任意代码执行。
Ruby on Rails远程代码执行漏洞
PoC代码
暂无相关漏洞推荐
- POC CVE-2015-3224: Ruby on Rails Web Console - Remote Code Execution
- POC CVE-2018-3760: Ruby On Rails - Local File Inclusion
- POC CVE-2019-5418: Rails File Content Disclosure
- POC CVE-2020-8163: Ruby on Rails <5.0.1 - Remote Code Execution
- POC CVE-2021-33564: Ruby Dragonfly <1.4.0 - Remote Code Execution
- POC CVE-2018-3760: Ruby On Rails Path Traversal
- POC CVE-2019-5418: Rails File Content Disclosure
- POC privesc-ruby: Ruby - Privilege Escalation
- POC cmdi-ruby-open-rce: Ruby Kernel#open/URI.open RCE
- POC ruby-on-rails-framework-exceptions: Ruby on Rails Framework Exceptions
- POC rails-database-config: Ruby on Rails Database Configuration File - Detect
- POC environment-rb: Environment Ruby File Disclosure
- POC rails-secret-token-disclosure: Ruby on Rails Secret Token Disclosure