A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated...
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HHigh · next 30 days
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalate to a remote code execution exploit.
modules/exploits/multi/http/rails_double_tap.rb
A vulnerability can allow an attacker to guess the automatically generated development mode secret token.
Ruby反序列化命令执行漏洞（CVE-2019-5420）-vulfocus通关版
RCE on Rails 5.2.2 using a path traversal (CVE-2019-5418) and a deserialization of Ruby objects (CVE-2019-5420)
Exploit for the Rails CVE-2019-5420
cve-2019-5420 POC simple ruby script
CVE-2019-5420 (Ruby on Rails)
Proof-of-concept exploit for CVE-2019-5420, a remote code execution vulnerability in Ruby on Rails, designed for educational purposes.
Python exploit script for CVE-2019-5420, targeting Ruby on Rails signed-session AES GCM key brute-forcing to achieve remote code execution in development/staging environments.
Exploit in Rails Development Mode. With some knowledge of a target application it is possible for an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalate to a remote code execution exploit.
POC Exploit written in Ruby
A PoC of CVE-2019-5420 I made for PentesterLab
Metasploit · linux · May 2, 2019
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.