# Remote code execution using render :inline

Rails render method passed unverified params[:id] allows inline template code injection, enabling arbitrary Ruby code execution on affected Action Pack versions.

- Payout: $1,500
- Severity: critical
- Program: Ruby on Rails
- Found by: kratob2
- Disclosed: 2016-03-01
- CVE: CVE-2016-0752
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/113928
- Library page: https://bugbountylibrary.com/r/h1%3A113928
- Tags: area:web domain:web impact:rce kind:bounty platform:hackerone sev:critical tech:ruby technique:source-review vuln:command-injection vuln:rce

**Target:** Action Pack render method in controllers/views
**Root cause:** Applications pass unverified user input to the render method in a controller or view, allowing the input to be interpreted as an inline template and execute arbitrary Ruby code.
**Steps:**
1. Identify a controller action that calls `render params[:id]` with unverified user input.
2. Send request parameters crafted so the value is coerced into an inline render template.
3. The render method evaluates the attacker-controlled inline template, executing arbitrary Ruby code.
**Exploitation:** Attacker controls request parameters passed directly to render; by coercing the parameter into an inline template, arbitrary Ruby code executes server-side, yielding remote code execution.
**Insight:** Grep Rails apps for `render params[...]` or any render call fed directly from request input; render treats strings as inline templates, so user-controlled render arguments become code execution.