Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am quite puzzled by how to test my rails app for the YAML vulnerability

first, I upgraded to the latest rails 3.2.11, and I tried this

It gave me not likely to be vulnerable or URIPATH must be set which should be reasonable since I upgraded to the latest rails.

But I checked another rails app which I abandoned long time ago, which I know isn't patched. I got the same result. Note that both of my apps run on heroku.

What is the difference between RHOSTS and VHOST and URI? Should RPORT be the http port or should it be the port that the webserver is running?

share|improve this question

Sorry for a short response, but I'm sure others will fill in eventually.

RPORT most likely means the port that the webserver is running on.

I've not used metasploit for this yet, unless Tinfoil Security uses the same concept, see:


share|improve this answer
so if I see in my rails log that the the webserver is running on port 52345 then that is the RPORT? or is it the port that the webserver listens to? – Nick Ginanto Feb 2 '13 at 12:04
Aha, sorry to not be so specific. It's the '52345' port in that scenario. – k0nsl Feb 2 '13 at 12:05
I've checked with tinfoil and it comes up as vulnerable, but my metasploit test shows as not vulnerable.. – Nick Ginanto Feb 2 '13 at 12:15

Disclaimer: I'm one of the developers at Tinfoil Security. We have a free and quick check at

Tinfoil's check was based off of Metasploit's original probe. I'm curious as to why we came up as vulnerable when Metasploit did not -- feel free to email or visit us at and we'd be happy to look into it. With that said, we've had instances of folks who have upgraded Rails but still had vulnerable middleware that still deserialized the payloads improperly so it's still important to check manually and make absolutely sure. In Rails 3.2.11 this is indicated by a Hash::DisallowedType exception being raised.

If your logs include parameters (default behavior), you can use that see if the payloads are being deserialized unsafely. Parameters: {"tinfoil_probe"=>1970-01-01 00:00:00 +0000} indicates that a Time object has been instantiated via the YAML. Psych::SyntaxError ((<unknown>): control characters are not allowed at line 1 column 1) indicates that framework tried to deserialize the YAML but it was malformed, which is an indicator that the framework is still vulnerable.

share|improve this answer
can you explain the metasploit parameters required for the test? – Nick Ginanto Feb 5 '13 at 7:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.