ruby-rail-properties CVE-2023-23138

This is a short view of ruby on rails properties misconfiguration sometimes developers forgot to disable this endpoint /rails/info/properties

if this endpoint was enabled on the host, that's mean an attacker can see part/all of the following information:

• Application root
• Environment mode
• Database adapter
• Database schema version
• Ruby version
• RubyGems version
• Rack version
• Rails version
• JavaScript Runtime
• Active Record version
• Action Pack version
• Action Mailer version
• Active Support version
• list of Middlewares

Testing on mass scale

I've create a nuclei template to check this missconfiguration you can use it as following:

nuclei -l <path of domains> -t ruby-rail-properties.yaml -rl 3000 -bs 3000

the results was also manually verfied to avoid false positives

a sample of one host would be similar to this :