rapid7/metasploit-framework — pull request #1480 by jjarmoc (2013-02-12 01:29:53+00:00)
Title: New module for Rails JSON/YAML vuln CVE-2013-0333

This is a new scanner module for the Rails JSON/YAML vuln CVE-2013-0333.

Based heavily on the scanner for CVE-2013-0156. Here's output from a number of different rails versions, also demonstrating that it works on URIPATH's that are 404.

Vulnerable - Rails 3.0.19 w/ working URIPATH;
[*] Probe response codes 200 / 200 / 500
[+] 127.0.0.1:3000 is likely vulnerable due to a 500 reply for invalid YAML
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

Vulnerable - Rails 3.0.19 w/ 404 URIPATH;
[*] Probe response codes 404 / 404 / 500
[+] 127.0.0.1:3000 is likely vulnerable due to a 500 reply for invalid YAML
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

Vulnerable - Rails 3.0.18 w/ 404 URIPath;
[*] Probe response codes 404 / 404 / 500
[+] 127.0.0.1:3000 is likely vulnerable due to a 500 reply for invalid YAML
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

Vulnerable - Rails 3.0.18 w/ working URIPath;
[*] Probe response codes 200 / 200 / 500
[+] 127.0.0.1:3000 is likely vulnerable due to a 500 reply for invalid YAML
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

Not vulnerable - Rails 3.0.20 w/ 404 URIPath;
[*] Probe response codes 404 / 500 / 500
[*] 127.0.0.1:3000 is not likely to be vulnerable or URIPATH must be set
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

Not vulnerable - Rails 3.0.20 w/ 404 URIPath;
[*] Probe response codes 200 / 500 / 500
[*] 127.0.0.1:3000 is not likely to be vulnerable or URIPATH must be set
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

Vulnerable - Rails 2.3.15 w/ working URIPath;
[*] Probe response codes 200 / 200 / 500
[+] 127.0.0.1:3000 is likely vulnerable due to a 500 reply for invalid YAML
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

Vulnerable - Rails 2.3.15 w/ 404 URIPath;
[*] Probe response codes 404 / 404 / 500
[+] 127.0.0.1:3000 is likely vulnerable due to a 500 reply for invalid YAML
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

Not Vulnerable - Rails 2.3.15 w/ 404 URIPath;
[*] Probe response codes 404 / 500 / 500
[*] 127.0.0.1:3000 is not likely to be vulnerable or URIPATH must be set
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

Not Vulnerable - Rails 2.3.15 w/ working URIPath;
[*] Probe response codes 200 / 500 / 500
[*] 127.0.0.1:3000 is not likely to be vulnerable or URIPATH must be set
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

Error - HTTP_METHOD set to 'BLARGH'
(Note, this doesn't actually work anymore due to OptEnum on HTTP_METHOD, but demonstrates what happens in an error condition.)
[-] 127.0.0.1:3000 The server replied with 500 for our initial JSON request
[-] Double check URIPATH and HTTP_METHOD
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed