CVE-2013-0156
active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not...
- Published
- Jan 13, 2013
- Updated
- Aug 6, 2024
- Assigning CNA
- redhat
- Evidence observed
- Jan 10, 2013
Primary CVSS
nvd · CVSS 2.0
AV:N/AC:L/Au:N/C:P/I:P/A:PHigh · next 30 days
- Percentile
- 99.9%
- Model date
- Oct 13, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
Sources
modules/auxiliary/scanner/http/rails_xml_yaml_scanner.rb
Metasploit Framework modulesDeclared conditions
- verification: check_not_declared($.auxiliary_scanner/http/rails_xml_yaml_scanner.check)
modules/exploits/multi/http/rails_secret_deserialization.rb
Metasploit Framework modulesDeclared conditions
- platform: Ruby($.exploit_multi/http/rails_secret_deserialization.platform)
- verification: check_not_declared($.exploit_multi/http/rails_secret_deserialization.check)
modules/exploits/multi/http/rails_xml_yaml_code_exec.rb
Metasploit Framework modulesDeclared conditions
- platform: Ruby($.exploit_multi/http/rails_xml_yaml_code_exec.platform)
- verification: check_not_declared($.exploit_multi/http/rails_xml_yaml_code_exec.check)
- CVE-2013-0156Exploit
Modified ruby script for RCE
- CVE-2013-0156Exploit
This script is specifically designed to solve the challenge on PentesterLab for the CVE-2013-0156 exploit
Bootstrapped Rails 3.2.10 to test the remote code exploit CVE-2013-0156
- kuang_grade_mk11Exploit
Pseudo shell for CVE-2013-0156.
- CVE-2013-0156Exploit
Arbitrary deserialization that can be used to trigger SQL injection and even Code execution
Silly Rails App to demonstrate vuln CVE-2013-0156
Metasploit · multiple · Jan 10, 2013
Metasploit · multiple · Aug 12, 2013
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.