Land #2419, nodejs_js_yaml_load_code_exec info

modules/exploits/multi/fileformat/nodejs_js_yaml_load_code_exec.rb

@@ -14,17 +14,24 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Nodejs js-yaml load() Code Exec',
+      'Name'           => 'Nodejs js-yaml load() Code Execution',
       'Description'    => %q{
-        For node.js applications that parse user-supplied YAML input using the
-        load() function from the 'js-yaml' package < 2.0.5, specifying a self-executing
-        function allows us to execute arbitrary javascript code.
+        This module can be used to abuse node.js applications that parse user-supplied YAML input
+        using the load() function from the 'js-yaml' package < 2.0.5, which doesn't properly handle
+        the unsafe !!js/function tag, allowing to specify a self-executing function which results
+        on execution of arbitrary javascript code.
       },
-      'Author'         => ['joev <jvennix[at]rapid7.com>'],
+      'Author'         =>
+        [
+          'Neal Poole', # Vulnerability discovery
+          'joev <jvennix[at]rapid7.com>' # Metasploit module
+        ],
       'License'        => MSF_LICENSE,
       'References'  =>
         [
           ['CVE', '2013-4660'],
+          ['OSVDB', '94656'],
+          ['BID', '60867'],
           ['URL', 'https://nealpoole.com/blog/2013/06/code-execution-via-yaml-in-js-yaml-nodejs-module/']
         ],
       'Platform'       => 'nodejs',