Ruby on rails Code Execution Vulnerability (cve-2020-8163) technical analysis, research, judgment and protection

Vulnerability profile

Ruby on Rails yes Rails A set of team based Ruby Open source language Web Application framework .

Ruby on Rails 5.0.1 Code injection vulnerability exists in previous versions . A remote attacker can use this vulnerability to send a crafted request to execute arbitrary code .

scope

Rails  < 5.0.1

Environment building

Reference resources https://github.com/QianliZLP/CVE-2020-8163- that will do

Loophole recurrence

Exp：

exploit.rb

#!/usr/bin/ruby
# Exploit Title: Remote code execution of user-provided local names in Rails < 5.0.1 and < 4.2.11.2
# Vendor Homepage: www.rubyonrails.org
# Software Link: www.rubyonrails.org
# V