Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am quite puzzled by how to test my rails app for the YAML vulnerability

first, I upgraded to the latest rails 3.2.11, and I tried this

It gave me not likely to be vulnerable or URIPATH must be set which should be reasonable since I upgraded to the latest rails.

But I checked another rails app which I abandoned long time ago, which I know isn't patched. I got the same result. Note that both of my apps run on heroku.

What is the difference between RHOSTS and VHOST and URI? Should RPORT be the http port or should it be the port that the webserver is running?

share|improve this question

2 Answers 2

Sorry for a short response, but I'm sure others will fill in eventually.

RPORT most likely means the port that the webserver is running on.

I've not used metasploit for this yet, unless Tinfoil Security uses the same concept, see: https://www.tinfoilsecurity.com/railscheck

-k0nsl

share|improve this answer
    
so if I see in my rails log that the the webserver is running on port 52345 then that is the RPORT? or is it the port that the webserver listens to? –  Nick Ginanto Feb 2 '13 at 12:04
    
Aha, sorry to not be so specific. It's the '52345' port in that scenario. –  k0nsl Feb 2 '13 at 12:05
    
I've checked with tinfoil and it comes up as vulnerable, but my metasploit test shows as not vulnerable.. –  Nick Ginanto Feb 2 '13 at 12:15

Disclaimer: I'm one of the developers at Tinfoil Security. We have a free and quick check at https://www.tinfoilsecurity.com/railscheck.

Tinfoil's check was based off of Metasploit's original probe. I'm curious as to why we came up as vulnerable when Metasploit did not -- feel free to email support@tinfoilsecurity.com or visit us at https://www.tinfoilsecurity.com/chat and we'd be happy to look into it. With that said, we've had instances of folks who have upgraded Rails but still had vulnerable middleware that still deserialized the payloads improperly so it's still important to check manually and make absolutely sure. In Rails 3.2.11 this is indicated by a Hash::DisallowedType exception being raised.

If your logs include parameters (default behavior), you can use that see if the payloads are being deserialized unsafely. Parameters: {"tinfoil_probe"=>1970-01-01 00:00:00 +0000} indicates that a Time object has been instantiated via the YAML. Psych::SyntaxError ((<unknown>): control characters are not allowed at line 1 column 1) indicates that framework tried to deserialize the YAML but it was malformed, which is an indicator that the framework is still vulnerable.

share|improve this answer
    
can you explain the metasploit parameters required for the test? –  Nick Ginanto Feb 5 '13 at 7:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.