CVE-2013-0156
published 2013-01-13CVE-2013-0156: active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly…
PriorityP180high7.5CVSS 2.0
AVNACLAuNCPIPAP
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
99.45%
99.9th percentile
active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
Affected
143 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| actionpack_project | actionpack | >= 0 < 2.3.15 | 2.3.15 |
| actionpack_project | actionpack | >= 3.0.0 < 3.0.19 | 3.0.19 |
| actionpack_project | actionpack | >= 3.1.0 < 3.1.10 | 3.1.10 |
| actionpack_project | actionpack | >= 3.2.0 < 3.2.11 | 3.2.11 |
| dan_kubb | extlib | <= 0.9.15 | — |
| dan_kubb | extlib | — | — |
| dan_kubb | extlib | — | — |
| dan_kubb | extlib | — | — |
| dan_kubb | extlib | — | — |
| dan_kubb | extlib | — | — |
| dan_kubb | extlib | — | — |
| dan_kubb | extlib | — | — |
| dan_kubb | extlib | — | — |
| dan_kubb | extlib | — | — |
| dan_kubb | extlib | — | — |
| dan_kubb | extlib | — | — |
| dan_kubb | extlib | — | — |
| dan_kubb | extlib | — | — |
| dan_kubb | extlib | >= 0 < 0.9.16 | 0.9.16 |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | rails | < rails 2.3.14.1 (bookworm) | rails 2.3.14.1 (bookworm) |
| debian | ruby-crack | < ruby-crack 0.3.2-1 (bookworm) | ruby-crack 0.3.2-1 (bookworm) |
| debian | ruby-extlib | < ruby-extlib 0.9.15-3 (bookworm) | ruby-extlib 0.9.15-3 (bookworm) |
| debian | ruby-multi-xml | — | — |
Detection & IOCsextracted from sources · hover to see the quote
snort↗
SID 25287
snort↗
SID 25288
- →Detect CVE-2013-0156 exploitation by inspecting XML POST request bodies for YAML or Symbol type casting directives (e.g., !ruby/hash or !ruby/object tags) passed to a Rails application. ↗
- →The RubyMiner campaign exploiting CVE-2013-0156 used Base64-encoded payloads in the POST body to evade detection; decode and inspect POST bodies to Rails endpoints for embedded shell commands. ↗
- →Detect exploit payloads embedding eval() with base64 unpack in YAML documents sent to Rails, specifically patterns like eval(%[...].unpack(%[m0])[0]). ↗
- →Flag HTTP requests with Content-Type: application/json that also include an X-HTTP-Method-Override header and a body containing !ruby/hash YAML tags, as this is the JSON/YAML deserialization exploit delivery pattern. ↗
- ·The Metasploit module for CVE-2013-0333 (JSON/YAML deserialization) is closely related to CVE-2013-0156 (XML/YAML deserialization) and shares the same YAML gadget chains; detections should cover both XML and JSON content-type vectors. ↗
- ·The YAML gadget chain technique used by the Metasploit exploit module requires Ruby 1.9 on the target; Ruby 1.8 targets may require the init_with() method instead and may not be caught by the same signatures. ↗
- ·The lochjol.com domain was observed in both a 2013 campaign and the 2018 RubyMiner campaign exploiting CVE-2013-0156, but the relationship between the two campaigns (shared attacker vs. coincidence) could not be confirmed. ↗
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
ghsa7.5HIGH
osv7.5HIGH
vulncheck7.5HIGH
vendor_debian7.5LOW
vendor_redhat7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
rubygem-activesupport: json to yaml parsing
vendor_redhat·2013-01-28·CVSS 7.5
CVE-2013-0333 [HIGH] CWE-502 rubygem-activesupport: json to yaml parsing
rubygem-activesupport: json to yaml parsing
lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.
Package: ruby193-rubygem-activesupport (OpenShift Enterprise 1) - Not affected
Red Hat
rubygem-crack: YAML parameter parsing vulnerability
vendor_redhat·2013-01-14·CVSS 7.5
CVE-2013-1800 [HIGH] CWE-502 rubygem-crack: YAML parameter parsing vulnerability
rubygem-crack: YAML parameter parsing vulnerability
The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
Package: rubygem-crack (OpenShift Enterprise 1) - Affected
Package: ruby193-rubygem-crack (Red Hat Satellite 6) - Affected
Red Hat
rubygem-activesupport: Multiple vulnerabilities in parameter parsing in ActionPack
vendor_redhat·2013-01-08·CVSS 7.5
CVE-2013-0156 [HIGH] CWE-502 rubygem-activesupport: Multiple vulnerabilities in parameter parsing in ActionPack
rubygem-activesupport: Multiple vulnerabilities in parameter parsing in ActionPack
active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
Statement: For details of affected products and workarounds see https://access.redhat.com/knowledge/node/290903
Debian
CVE-2013-0156: rails - active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0....
vendor_debian·2013·CVSS 7.5
CVE-2013-0156 [HIGH] CVE-2013-0156: rails - active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0....
active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
Scope: local
bookworm: resolved (fixed in 2.3.14.1)
bullseye: resolved (fixed in 2.3.14.1)
forky: resolved (fixed in 2.3.14.1)
sid: resolved (fixed in 2.3.14.1)
trixie: resolved (fixed in 2.3.14.1)
Debian
CVE-2013-1802: ruby-extlib - The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of s...
vendor_debian·2013·CVSS 7.5
CVE-2013-1802 [HIGH] CVE-2013-1802: ruby-extlib - The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of s...
The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
Scope: local
bookworm: resolved (fixed in 0.9.15-3)
bullseye: resolved (fixed in 0.9.15-3)
forky: resolved (fixed in 0.9.15-3)
sid: resolved (fixed in 0.9.15-3)
trixie: resolved (fixed in 0.9.15-3)
Debian
CVE-2013-0333: rails - lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 an...
vendor_debian·2013·CVSS 7.5
CVE-2013-0333 [HIGH] CVE-2013-0333: rails - lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 an...
lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.
Scope: local
bookworm: resolved (fixed in 2.3.14.1)
bullseye: resolved (fixed in 2.3.14.1)
forky: resolved (fixed in 2.3.14.1)
sid: resolved (fixed in 2.3.14.1)
trixie: resolved (fixed in 2.3.14.1)
Debian
CVE-2013-1800: ruby-crack - The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of str...
vendor_debian·2013·CVSS 7.5
CVE-2013-1800 [HIGH] CVE-2013-1800: ruby-crack - The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of str...
The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
Scope: local
bookworm: resolved (fixed in 0.3.2-1)
bullseye: resolved (fixed in 0.3.2-1)
forky: resolved (fixed in 0.3.2-1)
sid: resolved (fixed in 0.3.2-1)
trixie: resolved (fixed in 0.3.2-1)
Debian
CVE-2013-0175: ruby-multi-xml - multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other p...
vendor_debian·2013·CVSS 7.5
CVE-2013-0175 [HIGH] CVE-2013-0175: ruby-multi-xml - multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other p...
multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
OSV
extlib does not properly restrict casts of string values
osv·2017-10-24·CVSS 7.5
CVE-2013-1802 [HIGH] extlib does not properly restrict casts of string values
extlib does not properly restrict casts of string values
The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
OSV
crack does not properly restrict casts of string values
osv·2017-10-24·CVSS 7.5
CVE-2013-1800 [HIGH] crack does not properly restrict casts of string values
crack does not properly restrict casts of string values
The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
GHSA
nori contains Improper Input Validation
ghsa·2017-10-24·CVSS 7.5
CVE-2013-0285 [HIGH] CWE-20 nori contains Improper Input Validation
nori contains Improper Input Validation
The nori gem 2.0.x before 2.0.2, 1.1.x before 1.1.4, and 1.0.x before 1.0.3 for Ruby does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
GHSA
Improper Input Validation in multi_xml
ghsa·2017-10-24·CVSS 7.5
CVE-2013-0175 [HIGH] CWE-20 Improper Input Validation in multi_xml
Improper Input Validation in multi_xml
multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
GHSA
extlib does not properly restrict casts of string values
ghsa·2017-10-24·CVSS 7.5
CVE-2013-1802 [HIGH] CWE-704 extlib does not properly restrict casts of string values
extlib does not properly restrict casts of string values
The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
OSV
activesupport in Rails vulnerable to incorrect data conversion
osv·2017-10-24·CVSS 7.5
CVE-2013-0333 [HIGH] activesupport in Rails vulnerable to incorrect data conversion
activesupport in Rails vulnerable to incorrect data conversion
`lib/active_support/json/backends/yaml.rb` in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.
GHSA
HTTParty does not restrict casts of string values
ghsa·2017-10-24·CVSS 7.5
CVE-2013-1801 [HIGH] CWE-74 HTTParty does not restrict casts of string values
HTTParty does not restrict casts of string values
The httparty gem 0.9.0 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for YAML type conversion, a similar vulnerability to CVE-2013-0156.
GHSA
crack does not properly restrict casts of string values
ghsa·2017-10-24·CVSS 7.5
CVE-2013-1800 [HIGH] CWE-704 crack does not properly restrict casts of string values
crack does not properly restrict casts of string values
The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
OSV
actionpack Improper Input Validation vulnerability
osv·2017-10-24
CVE-2013-0156 [HIGH] actionpack Improper Input Validation vulnerability
actionpack Improper Input Validation vulnerability
`active_support/core_ext/hash/conversions.rb` in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
OSV
Improper Input Validation in multi_xml
osv·2017-10-24·CVSS 7.5
CVE-2013-0175 [HIGH] Improper Input Validation in multi_xml
Improper Input Validation in multi_xml
multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
OSV
nori contains Improper Input Validation
osv·2017-10-24·CVSS 7.5
CVE-2013-0285 [HIGH] nori contains Improper Input Validation
nori contains Improper Input Validation
The nori gem 2.0.x before 2.0.2, 1.1.x before 1.1.4, and 1.0.x before 1.0.3 for Ruby does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
OSV
HTTParty does not restrict casts of string values
osv·2017-10-24·CVSS 7.5
CVE-2013-1801 [HIGH] HTTParty does not restrict casts of string values
HTTParty does not restrict casts of string values
The httparty gem 0.9.0 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for YAML type conversion, a similar vulnerability to CVE-2013-0156.
GHSA
actionpack Improper Input Validation vulnerability
ghsa·2017-10-24
CVE-2013-0156 [HIGH] CWE-20 actionpack Improper Input Validation vulnerability
actionpack Improper Input Validation vulnerability
`active_support/core_ext/hash/conversions.rb` in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
GHSA
activesupport in Rails vulnerable to incorrect data conversion
ghsa·2017-10-24·CVSS 7.5
CVE-2013-0333 [HIGH] CWE-74 activesupport in Rails vulnerable to incorrect data conversion
activesupport in Rails vulnerable to incorrect data conversion
`lib/active_support/json/backends/yaml.rb` in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.
OSV
CVE-2013-0285: The nori gem 2
osv·2013-04-09·CVSS 7.5
CVE-2013-0285 [HIGH] CVE-2013-0285: The nori gem 2
The nori gem 2.0.x before 2.0.2, 1.1.x before 1.1.4, and 1.0.x before 1.0.3 for Ruby does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
OSV
CVE-2013-1800: The crack gem 0
osv·2013-04-09·CVSS 7.5
CVE-2013-1800 [HIGH] CVE-2013-1800: The crack gem 0
The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
OSV
CVE-2013-1802: The extlib gem 0
osv·2013-04-09·CVSS 7.5
CVE-2013-1802 [HIGH] CVE-2013-1802: The extlib gem 0
The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
OSV
CVE-2013-0333: lib/active_support/json/backends/yaml
osv·2013-01-30·CVSS 7.5
CVE-2013-0333 [HIGH] CVE-2013-0333: lib/active_support/json/backends/yaml
lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.
OSV
CVE-2013-0156: active_support/core_ext/hash/conversions
osv·2013-01-13·CVSS 7.5
CVE-2013-0156 [HIGH] CVE-2013-0156: active_support/core_ext/hash/conversions
active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
VulnCheck
rubyonrails rails Improper Input Validation
vulncheck·2013·CVSS 7.5
CVE-2013-0156 [HIGH] rubyonrails rails Improper Input Validation
rubyonrails rails Improper Input Validation
active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
Affected: rubyonrails rails
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://gist.github.com/ismasan/5647955; https://research.checkp
No detection rules found.
Exploit-DB
Ruby on Rails - Known Secret Session Cookie Remote Code Execution (Metasploit)
exploitdb·2013-08-12
CVE-2013-0156 Ruby on Rails - Known Secret Session Cookie Remote Code Execution (Metasploit)
Ruby on Rails - Known Secret Session Cookie Remote Code Execution (Metasploit)
---
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##
require 'msf/core'
class Metasploit3 NullSerializer)
# @serializer = options[:serializer] || Marshal
end
def encrypt_and_sign(value)
@verifier.generate(_encrypt(value))
end
def _encrypt(value)
cipher = new_cipher
cipher.encrypt
cipher.key = @secret
# Rely on OpenSSL for the initialization vector
iv = cipher.random_iv
#encrypted_data = cipher.update(@serializer.dump(value))
encrypted_data = cipher.update(value)
encrypted_data 'Ruby on Rails Known Secret Session Cookie Rem
Exploit-DB
Ruby on Rails - JSON Processor YAML Deserialization Code Execution (Metasploit)
exploitdb·2013-01-29·CVSS 7.5
CVE-2013-0333 [HIGH] Ruby on Rails - JSON Processor YAML Deserialization Code Execution (Metasploit)
Ruby on Rails - JSON Processor YAML Deserialization Code Execution (Metasploit)
---
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##
require 'msf/core'
class Metasploit3 'Ruby on Rails JSON Processor YAML Deserialization Code Execution',
'Description' => %q{
This module exploits a remote code execution vulnerability in the
JSON request processor of the Ruby on Rails application framework.
This vulnerability allows an attacker to instantiate a remote object,
which in turn can be used to execute any ruby code remotely in the
context of the application. This vulnerability is very similar to
CVE-2013-0156.
Exploit-DB
Ruby on Rails - XML Processor YAML Deserialization Code Execution (Metasploit)
exploitdb·2013-01-10
CVE-2013-0156 Ruby on Rails - XML Processor YAML Deserialization Code Execution (Metasploit)
Ruby on Rails - XML Processor YAML Deserialization Code Execution (Metasploit)
---
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##
require 'msf/core'
class Metasploit3 'Ruby on Rails XML Processor YAML Deserialization Code Execution',
'Description' => %q{
This module exploits a remote code execution vulnerability in the XML request
processor of the Ruby on Rails application framework. This vulnerability allows
an attacker to instantiate a remote object, which in turn can be used to execute
any ruby code remotely in the context of the application.
This module has been tested across multiple versions o
Metasploit
Ruby on Rails JSON Processor YAML Deserialization Code Execution
metasploit·CVSS 7.5
CVE-2013-0156 [HIGH] Ruby on Rails JSON Processor YAML Deserialization Code Execution
Ruby on Rails JSON Processor YAML Deserialization Code Execution
This module exploits a remote code execution vulnerability in the JSON request processor of the Ruby on Rails application framework. This vulnerability allows an attacker to instantiate a remote object, which in turn can be used to execute any ruby code remotely in the context of the application. This vulnerability is very similar to CVE-2013-0156. This module has been tested successfully on RoR 3.0.9, 3.0.19, and 2.3.15. The technique used by this module requires the target to be running a fairly recent version of Ruby 1.9 (since 2011 or so). Applications using Ruby 1.8 may still be exploitable using the init_with() method, but this has not been demonstrated.
Metasploit
Ruby on Rails XML Processor YAML Deserialization Code Execution
metasploit
Ruby on Rails XML Processor YAML Deserialization Code Execution
Ruby on Rails XML Processor YAML Deserialization Code Execution
This module exploits a remote code execution vulnerability in the XML request processor of the Ruby on Rails application framework. This vulnerability allows an attacker to instantiate a remote object, which in turn can be used to execute any ruby code remotely in the context of the application. This module has been tested across multiple versions of RoR 3.x and RoR 2.x The technique used by this module requires the target to be running a fairly recent version of Ruby 1.9 (since 2011 or so). Applications using Ruby 1.8 may still be exploitable using the init_with() method, but this has not been demonstrated.
Metasploit
Ruby on Rails Known Secret Session Cookie Remote Code Execution
metasploit
Ruby on Rails Known Secret Session Cookie Remote Code Execution
Ruby on Rails Known Secret Session Cookie Remote Code Execution
This module implements Remote Command Execution on Ruby on Rails applications. Prerequisite is knowledge of the "secret_token" (Rails 2/3) or "secret_key_base" (Rails 4). The values for those can be usually found in the file "RAILS_ROOT/config/initializers/secret_token.rb". The module achieves RCE by deserialization of a crafted Ruby Object.
Nuclei
Infoblox NetMRI < 7.6.1 - Remote Code Execution via Hardcoded Ruby Cookie Secret Key
nuclei·CVSS 7.5
[HIGH] Infoblox NetMRI < 7.6.1 - Remote Code Execution via Hardcoded Ruby Cookie Secret Key
Infoblox NetMRI < 7.6.1 - Remote Code Execution via Hardcoded Ruby Cookie Secret Key
Infoblox NetMRI virtual appliances before version 7.6.1 are vulnerable to remote code execution (RCE) due to the use of a hardcoded Ruby on Rails session cookie secret key. The Rails web component deserializes session cookies if the signing key is valid. Attackers with knowledge of this key can craft malicious session cookies that are deserialized by the application, leading to arbitrary code execution. This vulnerability is related to the known Ruby on Rails deserialization flaw (CVE-2013-0156). Infoblox did not assign a new CVE for this issue, as it is a result of the underlying Rails vulnerability.
Template:
id: infoblox-netmri-rails-cookie-rce
info:
name: Infoblox NetMRI < 7.6.1 - Remote Code Execu
Metasploit
Ruby on Rails XML Processor YAML Deserialization Scanner
metasploit
Ruby on Rails XML Processor YAML Deserialization Scanner
Ruby on Rails XML Processor YAML Deserialization Scanner
This module attempts to identify Ruby on Rails instances vulnerable to an arbitrary object instantiation flaw in the XML request processor.
Bugzilla
CVE-2013-1655 Puppet: Master code loading Ruby symbols vulnerability
bugzilla·2013-03-10·CVSS 7.5
CVE-2013-1655 [HIGH] CVE-2013-1655 Puppet: Master code loading Ruby symbols vulnerability
CVE-2013-1655 Puppet: Master code loading Ruby symbols vulnerability
Moses Mendoza ([email protected]) reports:
CVE-2013-1655 - Unauthenticated remote code execution risk
* Affected versions: 2.7.0 and greater
* Affects puppet masters running ruby 1.9.3 and up
* Patched versions: 2.7.x, 3.1.x
A bug in Puppet allows unauthenticated clients to send requests to the
puppet master, and have the master load code in an unsafe manner. This
has the potential for causing problems such as described in the Rails
CVE-2013-0156, though we have not identified an exploit at this time.
It only affects users whose puppet masters are running ruby 1.9.3 and
above.
External References:
https://puppetlabs.com/security/cve/cve-2013-1655/
Discussion:
Created puppet tracking bugs for this issue
Affects:
Bugzilla
CVE-2013-0333 rubygem-activesupport: json to yaml parsing
bugzilla·2013-01-24·CVSS 7.5
CVE-2013-0333 [HIGH] CVE-2013-0333 rubygem-activesupport: json to yaml parsing
CVE-2013-0333 rubygem-activesupport: json to yaml parsing
The Ruby on Rails project reports:
Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3
There is a vulnerability in the JSON code for Ruby on Rails which allows
attackers to bypass authentication systems, inject arbitrary SQL, inject and
execute arbitrary code, or perform a DoS attack on a Rails application. This
vulnerability has been assigned the CVE identifier CVE-2013-0333.
Versions Affected: 2.3.x, 3.0.x
Not Affected: 3.1.x, 3.2.x
Fixed Versions: 3.0.20, 2.3.16
Impact
The JSON Parsing code in Rails 2.3 and 3.0 support multiple parsing backends.
One of the backends involves transforming the JSON into YAML, and passing that
through the YAML parser. Using a specially crafted payload attackers can trick
the backend into d
Bugzilla
CVE-2013-0155 CVE-2013-0156 rubygem-actionpack various flaws [fedora-all]
bugzilla·2013-01-09·CVSS 6.4
CVE-2013-0155 [MEDIUM] CVE-2013-0155 CVE-2013-0156 rubygem-actionpack various flaws [fedora-all]
CVE-2013-0155 CVE-2013-0156 rubygem-actionpack various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
Please note: this issue affects
Bugzilla
CVE-2013-0156 rubygem-activesupport: Multiple vulnerabilities in parameter parsing in ActionPack
bugzilla·2013-01-08·CVSS 4.3
CVE-2013-0156 [MEDIUM] CVE-2013-0156 rubygem-activesupport: Multiple vulnerabilities in parameter parsing in ActionPack
CVE-2013-0156 rubygem-activesupport: Multiple vulnerabilities in parameter parsing in ActionPack
The Ruby on Rails project reports:
Multiple vulnerabilities in parameter parsing in ActionPack
There are multiple weaknesses in the parameter parsing code for Ruby on Rails
which could allow attackers to bypass authentication systems, inject arbitrary
SQL, inject an execute arbitrary code, or perform a DoS attack on a rails
application. This vulnerability has been assigned the CVE identifier
CVE-2013-0156.
Versions Affected: ALL versions
Not affected: NONE
Fixed Versions: 3.2.11, 3.1.10, 3.0.19, 2.3.15
Impact
The XML parameter parsing code of Ruby on Rails allows applications to
automatically to cast values from strings to certain data types.
Unfortunately the type casting code supported c
Bugzilla
CVE-2012-3463 CVE-2012-3464 CVE-2012-3465 CVE-2013-0156 rubygem-actionpack various flaws [epel-5]
bugzilla·2012-08-10·CVSS 4.3
CVE-2012-3463 [MEDIUM] CVE-2012-3463 CVE-2012-3464 CVE-2012-3465 CVE-2013-0156 rubygem-actionpack various flaws [epel-5]
CVE-2012-3463 CVE-2012-3464 CVE-2012-3465 CVE-2013-0156 rubygem-actionpack various flaws [epel-5]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include this bug ID and the
bug IDs of this bug's parent bugs filed against the "Security Response"
product (the top-level CVE bugs). Please mention the CVE IDs being fixed
in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/updat
Checkpoint
‘RubyMiner’ Cryptominer Affects 30% of WW Networks
blogs_checkpoint·2018-01-11
CVE-2013-0156 ‘RubyMiner’ Cryptominer Affects 30% of WW Networks
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
AI Research 2
Android Malware 23
Artificial Intelligence 4
ChatGPT 3
Check Point Research Publications 455
Cloud Security 1
CPRadio 44
Crypto 2
Data & Threat Intelligence 2
Data Analysis 0
Demos 22
Global Cyber Attack Reports 408
How To Guides 13
Ransomware 5
Russo-Ukrainian War 1
Security Report 1
Threat and data analysis 0
Threat Research 174
Web 3.0 Security 11
Wipers 0
## ‘RubyMiner’ Cryptominer Affects 30% of WW Networks
In the last 24 hours, 30% of networks worldwide have experienced compromise attempts by a crypto-miner targeting web servers.
During tha
Talos
The Ruby on Rails vulnerability that made Metasploit release a patch
blogs_talos·2013-01-10·CVSS 7.5
CVE-2013-0156 [HIGH] The Ruby on Rails vulnerability that made Metasploit release a patch
## The Ruby on Rails vulnerability that made Metasploit release a patch
This post on the Ruby on Rails Security group January 8th contained a few phrases that cause alarm when used together: "inject arbitrary SQL", "inject and execute arbitrary code" and "perform a DoS attack on a Rails application". Without going into detail the post discussed how user-provided YAML and Symbol data could be crafted to exploit Rails applications and given the identifier CVE-2013-0156.
Rails is used in many projects, including one of the most widespread pentesting frameworks available, Metasploit. Within hours of the post, Metasploit had a security update published for itself ( 2013010202 ) and was actively looking into creating a module for exploitation.
The only information to go with before the PoC wa
Talos
The Ruby on Rails vulnerability that made Metasploit release a patch
blogs_talos·2013-01-10·CVSS 7.5
CVE-2013-0156 [HIGH] The Ruby on Rails vulnerability that made Metasploit release a patch
This post on the Ruby on Rails Security group January 8th contained a few phrases that cause alarm when used together: "inject arbitrary SQL", "inject and execute arbitrary code" and "perform a DoS attack on a Rails application". Without going into detail the post discussed how user-provided YAML and Symbol data could be crafted to exploit Rails applications and given the identifier CVE-2013-0156.
Rails is used in many projects, including one of the most widespread pentesting frameworks available, Metasploit. Within hours of the post, Metasploit had a security update published for itself (2013010202) and was actively looking into creating a module for exploitation.
The only information to go with before the PoC was released was that Rails could take YAML or Symbol input through xml that
http://ics-cert.us-cert.gov/advisories/ICSA-13-036-01Ahttp://lists.apple.com/archives/security-announce/2013/Mar/msg00002.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0153.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0154.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0155.htmlhttp://weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released/http://www.debian.org/security/2013/dsa-2604http://www.fujitsu.com/global/support/software/security/products-f/sw-sv-rcve-ror201301e.htmlhttp://www.insinuator.net/2013/01/rails-yaml/http://www.kb.cert.org/vuls/id/380039http://www.kb.cert.org/vuls/id/628463https://community.rapid7.com/community/metasploit/blog/2013/01/09/serialization-mischief-in-ruby-land-cve-2013-0156https://groups.google.com/group/rubyonrails-security/msg/c1432d0f8c70e89d?dmode=source&output=gplainhttps://puppet.com/security/cve/cve-2013-0156http://ics-cert.us-cert.gov/advisories/ICSA-13-036-01Ahttp://lists.apple.com/archives/security-announce/2013/Mar/msg00002.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0153.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0154.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0155.htmlhttp://weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released/http://www.debian.org/security/2013/dsa-2604http://www.fujitsu.com/global/support/software/security/products-f/sw-sv-rcve-ror201301e.htmlhttp://www.insinuator.net/2013/01/rails-yaml/http://www.kb.cert.org/vuls/id/380039http://www.kb.cert.org/vuls/id/628463https://community.rapid7.com/community/metasploit/blog/2013/01/09/serialization-mischief-in-ruby-land-cve-2013-0156https://groups.google.com/group/rubyonrails-security/msg/c1432d0f8c70e89d?dmode=source&output=gplainhttps://puppet.com/security/cve/cve-2013-0156
2013-01-13
Published
Exploited in the wild