CVE-2013-0333
published 2013-01-30CVE-2013-0333: lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for…
PriorityP276high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
95.57%
99.9th percentile
lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.
Affected
37 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | rails | < rails 2.3.14.1 (bookworm) | rails 2.3.14.1 (bookworm) |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Exploit sends requests with Content-Type 'application/json' containing embedded YAML payloads using !ruby/hash and !ruby/object tags; inspect JSON request bodies for YAML deserialization gadget strings. ↗
- →Exploit sets the X-HTTP-Method-Override header to 'get' alongside the malicious JSON body; this header combination is a strong indicator of exploitation attempts. ↗
- →Payload is base64-encoded and decoded at runtime via .unpack('m0'); look for base64 blobs inside JSON request bodies paired with eval() calls. ↗
- →Colons in the YAML payload are Unicode-escaped as \u003a to bypass naive filters; detection rules should normalize or decode Unicode escapes before matching. ↗
- →Exploit sends two sequential requests, one targeting Rails 2 (ActionController) and one targeting Rails 3 (ActionDispatch); two near-simultaneous JSON POST requests with YAML gadget bodies to the same URI is a strong signal. ↗
- ·The code execution technique used by the Metasploit module requires Ruby 1.9; Ruby 1.8 targets may still be vulnerable via init_with() but this vector was not demonstrated and may require a different payload. ↗
- ·The HTTP method used for exploitation is configurable (GET, POST, PUT); detection rules should not restrict matching to a single HTTP verb. ↗
- ·The target URI path is configurable by the attacker; there is no fixed path to block — any application endpoint accepting JSON is potentially vulnerable. ↗
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
ghsa7.5HIGH
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
rubygem-activesupport: json to yaml parsing
vendor_redhat·2013-01-28·CVSS 7.5
CVE-2013-0333 [HIGH] CWE-502 rubygem-activesupport: json to yaml parsing
rubygem-activesupport: json to yaml parsing
lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.
Package: ruby193-rubygem-activesupport (OpenShift Enterprise 1) - Not affected
Debian
CVE-2013-0333: rails - lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 an...
vendor_debian·2013·CVSS 7.5
CVE-2013-0333 [HIGH] CVE-2013-0333: rails - lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 an...
lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.
Scope: local
bookworm: resolved (fixed in 2.3.14.1)
bullseye: resolved (fixed in 2.3.14.1)
forky: resolved (fixed in 2.3.14.1)
sid: resolved (fixed in 2.3.14.1)
trixie: resolved (fixed in 2.3.14.1)
OSV
activesupport in Rails vulnerable to incorrect data conversion
osv·2017-10-24·CVSS 7.5
CVE-2013-0333 [HIGH] activesupport in Rails vulnerable to incorrect data conversion
activesupport in Rails vulnerable to incorrect data conversion
`lib/active_support/json/backends/yaml.rb` in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.
GHSA
activesupport in Rails vulnerable to incorrect data conversion
ghsa·2017-10-24·CVSS 7.5
CVE-2013-0333 [HIGH] CWE-74 activesupport in Rails vulnerable to incorrect data conversion
activesupport in Rails vulnerable to incorrect data conversion
`lib/active_support/json/backends/yaml.rb` in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.
OSV
CVE-2013-0333: lib/active_support/json/backends/yaml
osv·2013-01-30·CVSS 7.5
CVE-2013-0333 [HIGH] CVE-2013-0333: lib/active_support/json/backends/yaml
lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.
No detection rules found.
Exploit-DB
Ruby on Rails - JSON Processor YAML Deserialization Code Execution (Metasploit)
exploitdb·2013-01-29·CVSS 7.5
CVE-2013-0333 [HIGH] Ruby on Rails - JSON Processor YAML Deserialization Code Execution (Metasploit)
Ruby on Rails - JSON Processor YAML Deserialization Code Execution (Metasploit)
---
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##
require 'msf/core'
class Metasploit3 'Ruby on Rails JSON Processor YAML Deserialization Code Execution',
'Description' => %q{
This module exploits a remote code execution vulnerability in the
JSON request processor of the Ruby on Rails application framework.
This vulnerability allows an attacker to instantiate a remote object,
which in turn can be used to execute any ruby code remotely in the
context of the application. This vulnerability is very similar to
CVE-2013-0156.
Metasploit
Ruby on Rails JSON Processor YAML Deserialization Code Execution
metasploit·CVSS 7.5
CVE-2013-0156 [HIGH] Ruby on Rails JSON Processor YAML Deserialization Code Execution
Ruby on Rails JSON Processor YAML Deserialization Code Execution
This module exploits a remote code execution vulnerability in the JSON request processor of the Ruby on Rails application framework. This vulnerability allows an attacker to instantiate a remote object, which in turn can be used to execute any ruby code remotely in the context of the application. This vulnerability is very similar to CVE-2013-0156. This module has been tested successfully on RoR 3.0.9, 3.0.19, and 2.3.15. The technique used by this module requires the target to be running a fairly recent version of Ruby 1.9 (since 2011 or so). Applications using Ruby 1.8 may still be exploitable using the init_with() method, but this has not been demonstrated.
Metasploit
Ruby on Rails JSON Processor YAML Deserialization Scanner
metasploit
Ruby on Rails JSON Processor YAML Deserialization Scanner
Ruby on Rails JSON Processor YAML Deserialization Scanner
This module attempts to identify Ruby on Rails instances vulnerable to an arbitrary object instantiation flaw in the JSON request processor.
Bugzilla
CVE-2013-0333 rubygem-activesupport: json to yaml parsing [fedora-16]
bugzilla·2013-01-29·CVSS 7.5
CVE-2013-0333 [HIGH] CVE-2013-0333 rubygem-activesupport: json to yaml parsing [fedora-16]
CVE-2013-0333 rubygem-activesupport: json to yaml parsing [fedora-16]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
fedora-16 tracking bug for rubygem-
Bugzilla
CVE-2013-0333 rubygem-activesupport: json to yaml parsing [epel-5]
bugzilla·2013-01-29·CVSS 7.5
CVE-2013-0333 [HIGH] CVE-2013-0333 rubygem-activesupport: json to yaml parsing [epel-5]
CVE-2013-0333 rubygem-activesupport: json to yaml parsing [epel-5]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
epel-5 tracking bug for rubygem-a
Bugzilla
CVE-2013-0333 rubygem-activesupport: json to yaml parsing [fedora-17]
bugzilla·2013-01-29·CVSS 7.5
CVE-2013-0333 [HIGH] CVE-2013-0333 rubygem-activesupport: json to yaml parsing [fedora-17]
CVE-2013-0333 rubygem-activesupport: json to yaml parsing [fedora-17]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
fedora-17 tracking bug for rubygem-
Bugzilla
CVE-2013-0333 rubygem-activesupport: json to yaml parsing [epel-6]
bugzilla·2013-01-29·CVSS 7.5
CVE-2013-0333 [HIGH] CVE-2013-0333 rubygem-activesupport: json to yaml parsing [epel-6]
CVE-2013-0333 rubygem-activesupport: json to yaml parsing [epel-6]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
epel-6 tracking bug for rubygem-a
Bugzilla
CVE-2013-0333 rubygem-activesupport: json to yaml parsing
bugzilla·2013-01-24·CVSS 7.5
CVE-2013-0333 [HIGH] CVE-2013-0333 rubygem-activesupport: json to yaml parsing
CVE-2013-0333 rubygem-activesupport: json to yaml parsing
The Ruby on Rails project reports:
Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3
There is a vulnerability in the JSON code for Ruby on Rails which allows
attackers to bypass authentication systems, inject arbitrary SQL, inject and
execute arbitrary code, or perform a DoS attack on a Rails application. This
vulnerability has been assigned the CVE identifier CVE-2013-0333.
Versions Affected: 2.3.x, 3.0.x
Not Affected: 3.1.x, 3.2.x
Fixed Versions: 3.0.20, 2.3.16
Impact
The JSON Parsing code in Rails 2.3 and 3.0 support multiple parsing backends.
One of the backends involves transforming the JSON into YAML, and passing that
through the YAML parser. Using a specially crafted payload attackers can trick
the backend into d
http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.htmlhttp://lists.apple.com/archives/security-announce/2013/Mar/msg00002.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0201.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0202.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0203.htmlhttp://support.apple.com/kb/HT5784http://weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released/http://www.debian.org/security/2013/dsa-2613http://www.kb.cert.org/vuls/id/628463https://groups.google.com/group/rubyonrails-security/msg/52179af76915e518?dmode=source&output=gplainhttps://puppet.com/security/cve/cve-2013-0333http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.htmlhttp://lists.apple.com/archives/security-announce/2013/Mar/msg00002.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0201.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0202.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0203.htmlhttp://support.apple.com/kb/HT5784http://weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released/http://www.debian.org/security/2013/dsa-2613http://www.kb.cert.org/vuls/id/628463https://groups.google.com/group/rubyonrails-security/msg/52179af76915e518?dmode=source&output=gplainhttps://puppet.com/security/cve/cve-2013-0333
2013-01-30
Published