How to test my website for the rails YAML vulnerability

Question

I am quite puzzled by how to test my rails app for the YAML vulnerability

first, I upgraded to the latest rails 3.2.11, and I tried this

It gave me not likely to be vulnerable or URIPATH must be set which should be reasonable since I upgraded to the latest rails.

But I checked another rails app which I abandoned long time ago, which I know isn't patched. I got the same result. Note that both of my apps run on heroku.

What is the difference between RHOSTS and VHOST and URI? Should RPORT be the http port or should it be the port that the webserver is running?

Answer 1

Sorry for a short response, but I'm sure others will fill in eventually.

RPORT most likely means the port that the webserver is running on.

I've not used metasploit for this yet, unless Tinfoil Security uses the same concept, see: https://www.tinfoilsecurity.com/railscheck

-k0nsl

Answer 2

Disclaimer: I'm one of the developers at Tinfoil Security. We have a free and quick check at https://www.tinfoilsecurity.com/railscheck.

Tinfoil's check was based off of Metasploit's original probe. I'm curious as to why we came up as vulnerable when Metasploit did not -- feel free to email support@tinfoilsecurity.com or visit us at https://www.tinfoilsecurity.com/chat and we'd be happy to look into it. With that said, we've had instances of folks who have upgraded Rails but still had vulnerable middleware that still deserialized the payloads improperly so it's still important to check manually and make absolutely sure. In Rails 3.2.11 this is indicated by a Hash::DisallowedType exception being raised.

If your logs include parameters (default behavior), you can use that see if the payloads are being deserialized unsafely. Parameters: {"tinfoil_probe"=>1970-01-01 00:00:00 +0000} indicates that a Time object has been instantiated via the YAML. Psych::SyntaxError ((<unknown>): control characters are not allowed at line 1 column 1) indicates that framework tried to deserialize the YAML but it was malformed, which is an indicator that the framework is still vulnerable.