Metasploit Rails 3 Remote Code Execution Hours Away
Expect a point-and-click exploit that will run <i>arbitrary code</i> on vulnerable servers.<p>If you've never dealt with a problem like this, you may not be ready. So, here's the most important thing you need to understand:<p><i>If you have a vulnerable application</i> anywhere, on any port <i>it will be found and compromised. This is a spray-and-pray vulnerability.</i> It costs attackers nothing to try, attempts don't crash servers, and so people will try <i>everywhere</i>.<p>If you lose an application in your data center / hosting environment, that's the ballgame. It doesn't matter that the app you lost was the testing instance of a status dashboard with no real data in it, because the exploit coughs up shell access on that server. If there is one thing every black-hat attacker in the world is truly gifted at, it is pivoting from shell access on one server to shell access on every goddam server.<p>Please make sure you didn't just patch the app servers you know/care about. THEY ALL NEED TO BE PATCHED OR RETIRED.<p>Additionally:<p>* If you are one of those "same password on a whole bunch of services people", now is a good time to make sure nothing you care about has that password. Some app somewhere is about to lose that password.<p>* Now would not be the worst time in the world to go to your Twitter config, hit Settings -> Apps, and scrub out all the stuff you don't use.<p>* Now you know why you never give 3rd party web apps your Gmail password.