CVE-2013-0156
active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not...
- Published
- Jan 13, 2013
- Updated
- Aug 6, 2024
- Assigning CNA
- redhat
- Evidence observed
- Jan 10, 2013
Primary CVSS
nvd · CVSS 2.0
AV:N/AC:L/Au:N/C:P/I:P/A:PHigh · next 30 days
- Percentile
- 99.9%
- Model date
- Oct 13, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
Sources
modules/auxiliary/scanner/http/rails_xml_yaml_scanner.rb
Metasploit Framework modulesDeclared conditions
- verification: check_not_declared($.auxiliary_scanner/http/rails_xml_yaml_scanner.check)
modules/exploits/multi/http/rails_secret_deserialization.rb
Metasploit Framework modulesDeclared conditions
- platform: Ruby($.exploit_multi/http/rails_secret_deserialization.platform)
- verification: check_not_declared($.exploit_multi/http/rails_secret_deserialization.check)
modules/exploits/multi/http/rails_xml_yaml_code_exec.rb
Metasploit Framework modulesDeclared conditions
- platform: Ruby($.exploit_multi/http/rails_xml_yaml_code_exec.platform)
- verification: check_not_declared($.exploit_multi/http/rails_xml_yaml_code_exec.check)
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.