forced-request/rails-rce-cve-2016-0752Proof-of-concept exploit for CVE-2016-0752, a remote code execution vulnerability in Ruby on Rails via dynamic render paths. Includes vulnerable app, exploitation steps, and reference to Metasploit module.
This app serves as a vulnerable Proof of Concept for exploiting CVE-2016-0752. For more information refer to this blog post, which explains the vulnerability, the steps required to exploit, the fix, and a link to a metasploit module.
echo "" > log/development.log # Clear out the log file
rvm use 2.2.3
bundle
rails s
Vulnerable URL: http://localhost/users/dashboard