Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-jmgw-6vjg-jjwg
Advisory ID github_osv/GHSA-jmgw-6vjg-jjwg
Aliases CVE-2013-0156
Summary actionpack Improper Input Validation vulnerability `active_support/core_ext/hash/conversions.rb` in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
Status Published
Exploitability 2.0
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (0)
There are no known CWE.
System Score Found at
generic_textual HIGH
Reference id Reference type URL
http://rhn.redhat.com/errata/RHSA-2013-0153.html
http://rhn.redhat.com/errata/RHSA-2013-0154.html
http://rhn.redhat.com/errata/RHSA-2013-0155.html
https://community.rapid7.com/community/metasploit/blog/2013/01/09/serialization-mischief-in-ruby-land-cve-2013-0156
https://github.com/rails/rails
https://groups.google.com/group/rubyonrails-security/msg/c1432d0f8c70e89d?dmode=source&output=gplain
https://web.archive.org/web/20140111025708/http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html
https://web.archive.org/web/20160415043747/https://ics-cert.us-cert.gov/advisories/ICSA-13-036-01A
https://web.archive.org/web/20160806154149/https://puppet.com/security/cve/cve-2013-0156
http://weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released
http://www.debian.org/security/2013/dsa-2604
http://www.fujitsu.com/global/support/software/security/products-f/sw-sv-rcve-ror201301e.html
http://www.insinuator.net/2013/01/rails-yaml
http://www.kb.cert.org/vuls/id/380039
http://www.kb.cert.org/vuls/id/628463
CVE-2013-0156 https://nvd.nist.gov/vuln/detail/CVE-2013-0156
Data source Metasploit
Description This module exploits a remote code execution vulnerability in the XML request processor of the Ruby on Rails application framework. This vulnerability allows an attacker to instantiate a remote object, which in turn can be used to execute any ruby code remotely in the context of the application. This module has been tested across multiple versions of RoR 3.x and RoR 2.x The technique used by this module requires the target to be running a fairly recent version of Ruby 1.9 (since 2011 or so). Applications using Ruby 1.8 may still be exploitable using the init_with() method, but this has not been demonstrated.
Note 
Reliability:
  - unknown-reliability
Stability:
  - unknown-stability
SideEffects:
  - unknown-side-effects
Ransomware campaign use Unknown
Source publication date Jan. 7, 2013
Platform Ruby
Source URL https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/http/rails_xml_yaml_code_exec.rb
Data source Exploit-DB
Date added Jan. 10, 2013
Description Ruby on Rails - XML Processor YAML Deserialization Code Execution (Metasploit)
Ransomware campaign use Known
Source publication date Jan. 10, 2013
Exploit type remote
Platform multiple
Source update date Jan. 10, 2013
Data source Metasploit
Description This module attempts to identify Ruby on Rails instances vulnerable to an arbitrary object instantiation flaw in the XML request processor.
Note 
Reliability:
  - unknown-reliability
Stability:
  - unknown-stability
SideEffects:
  - unknown-side-effects
Ransomware campaign use Unknown
Source URL https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/scanner/http/rails_xml_yaml_scanner.rb
Data source Metasploit
Description This module implements Remote Command Execution on Ruby on Rails applications. Prerequisite is knowledge of the "secret_token" (Rails 2/3) or "secret_key_base" (Rails 4). The values for those can be usually found in the file "RAILS_ROOT/config/initializers/secret_token.rb". The module achieves RCE by deserialization of a crafted Ruby Object.
Note 
Reliability:
  - unknown-reliability
Stability:
  - unknown-stability
SideEffects:
  - unknown-side-effects
Ransomware campaign use Unknown
Source publication date April 11, 2013
Platform Ruby
Source URL https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/http/rails_secret_deserialization.rb
Data source Metasploit
Description This module exploits a remote code execution vulnerability in the XML request processor of the Ruby on Rails application framework. This vulnerability allows an attacker to instantiate a remote object, which in turn can be used to execute any ruby code remotely in the context of the application. This module has been tested across multiple versions of RoR 3.x and RoR 2.x The technique used by this module requires the target to be running a fairly recent version of Ruby 1.9 (since 2011 or so). Applications using Ruby 1.8 may still be exploitable using the init_with() method, but this has not been demonstrated.
Note 
Reliability:
  - unknown-reliability
Stability:
  - unknown-stability
SideEffects:
  - unknown-side-effects
Ransomware campaign use Unknown
Source publication date Jan. 7, 2013
Platform Ruby
Source URL https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/http/rails_xml_yaml_code_exec.rb
Data source Exploit-DB
Date added Aug. 12, 2013
Description Ruby on Rails - Known Secret Session Cookie Remote Code Execution (Metasploit)
Ransomware campaign use Known
Source publication date Aug. 12, 2013
Exploit type remote
Platform multiple
Source update date Aug. 12, 2013

No EPSS data available for this advisory.

Patch URL
There are no known patches.

There are no known vectors.

There are no SSVC decisions available.