Staging Environment: Content and features may be unstable or change without notice.
Advisory details: gitlab / gem/activesupport/CVE-2013-0333
Advisory ID gitlab/gem/activesupport/CVE-2013-0333
Aliases CVE-2013-0333
Summary Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3 There is a vulnerability in the JSON code for Ruby on Rails which allows attackers to bypass authentication systems, inject arbitrary SQL, inject and execute arbitrary code, or perform a DoS attack on a Rails application.
Status Published
Exploitability 2.0
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (0)
There are no known CWE.
System Score Found at
cvssv2 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/activesupport/CVE-2013-0333.yml
Reference id Reference type URL
https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/1h2DR63ViGo
Data source Metasploit
Description This module exploits a remote code execution vulnerability in the JSON request processor of the Ruby on Rails application framework. This vulnerability allows an attacker to instantiate a remote object, which in turn can be used to execute any ruby code remotely in the context of the application. This vulnerability is very similar to CVE-2013-0156. This module has been tested successfully on RoR 3.0.9, 3.0.19, and 2.3.15. The technique used by this module requires the target to be running a fairly recent version of Ruby 1.9 (since 2011 or so). Applications using Ruby 1.8 may still be exploitable using the init_with() method, but this has not been demonstrated.
Note 
Reliability:
  - unknown-reliability
Stability:
  - unknown-stability
SideEffects:
  - unknown-side-effects
Ransomware campaign use Unknown
Source publication date Jan. 28, 2013
Platform Ruby
Source URL https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/http/rails_json_yaml_code_exec.rb
Data source Exploit-DB
Date added Jan. 29, 2013
Description Ruby on Rails - JSON Processor YAML Deserialization Code Execution (Metasploit)
Ransomware campaign use Known
Source publication date Jan. 29, 2013
Exploit type remote
Platform multiple
Source update date Jan. 29, 2013
Data source Metasploit
Description This module exploits a remote code execution vulnerability in the JSON request processor of the Ruby on Rails application framework. This vulnerability allows an attacker to instantiate a remote object, which in turn can be used to execute any ruby code remotely in the context of the application. This vulnerability is very similar to CVE-2013-0156. This module has been tested successfully on RoR 3.0.9, 3.0.19, and 2.3.15. The technique used by this module requires the target to be running a fairly recent version of Ruby 1.9 (since 2011 or so). Applications using Ruby 1.8 may still be exploitable using the init_with() method, but this has not been demonstrated.
Note 
Reliability:
  - unknown-reliability
Stability:
  - unknown-stability
SideEffects:
  - unknown-side-effects
Ransomware campaign use Unknown
Source publication date Jan. 28, 2013
Platform Ruby
Source URL https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/http/rails_json_yaml_code_exec.rb
Data source Metasploit
Description This module attempts to identify Ruby on Rails instances vulnerable to an arbitrary object instantiation flaw in the JSON request processor.
Note 
Reliability:
  - unknown-reliability
Stability:
  - unknown-stability
SideEffects:
  - unknown-side-effects
Ransomware campaign use Unknown
Source URL https://github.com/rapid7/metasploit-framework/tree/master/modules/auxiliary/scanner/http/rails_json_yaml_scanner.rb
Data source Exploit-DB
Date added Jan. 29, 2013
Description Ruby on Rails - JSON Processor YAML Deserialization Code Execution (Metasploit)
Ransomware campaign use Known
Source publication date Jan. 29, 2013
Exploit type remote
Platform multiple
Source update date Jan. 29, 2013

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P Found at https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/activesupport/CVE-2013-0333.yml
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete

There are no SSVC decisions available.