rapid7/metasploit-framework — pull request #1433 by jjarmoc (2013-02-03 22:21:14+00:00)
Title: rails_xml_yaml_scanner.rb improvements

Some adjustments to HD's scanner for CVE-2013-0156.

- Allows scanning of URIPATH's that return 404 or other 4xx, so long as they're processed by rails on the backend.
- Re-ordered logic to send less traffic in failure conditions (speeds scanning large subnets)
- Makes HTTP_METHOD configurable (PUT and GET are valid in addition to POST.)

I've tested this thoroughly, especially the 4xx response code changes which are the most significant. Results appear correct on the following versions of rails;

- 3.2.10 (vulnerable)
- 3.2.11 (not vulnerable)
- 3.1.9 (vulnerable)
- 3.1.10 (not vulnerable)
- 3.0.18 (vulnerable)
- 3.0.19 (not vulnerable)

I've tested on URIPATH's that return both 200 and 404 on each of those versions.

Have _not_ tested on 2.x versions, or when running w/ Ruby 1.8.