CVE-2013-0333

This Metasploit module exploits a YAML deserialization vulnerability in Ruby on Rails (CVE-2013-0333) to achieve remote code execution by embedding malicious YAML in JSON requests. It targets Rails 2.x and 3.x by leveraging the `NamedRouteCollection` vector to execute arbitrary Ruby code.

This repository contains a Ruby script to scan Heroku applications for vulnerable Rails versions affected by CVE-2013-0333. It checks installed Rails versions against known vulnerable ranges (2.3.0-2.3.15 and 3.0.0-3.0.19) and reports affected apps.

This Metasploit module scans for Ruby on Rails instances vulnerable to CVE-2013-0156 by sending JSON and YAML probes to detect deserialization flaws. It checks for inconsistent response codes to identify potential vulnerabilities.

This Metasploit module exploits a YAML deserialization vulnerability in Ruby on Rails (CVE-2013-0333) to achieve remote code execution. It crafts malicious YAML payloads embedded in JSON requests, targeting Rails 2.x and 3.x applications.