CVE-2023-26153
published 2023-10-06CVE-2023-26153: Versions of the package geokit-rails before 2.5.0 are vulnerable to Command Injection due to unsafe deserialisation of YAML within the 'geo_location' cookie…
PriorityP263critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
3.24%
86.7th percentile
Versions of the package geokit-rails before 2.5.0 are vulnerable to Command Injection due to unsafe deserialisation of YAML within the 'geo_location' cookie. This issue can be exploited remotely via a malicious cookie value. **Note:** An attacker can use this vulnerability to execute commands on the host system.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| geokit | geokit-rails | < 2.5.0 | 2.5.0 |
| geokit | geokit-rails | >= 0 < 2.5.0 | 2.5.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
geokit-rails Command Injection vulnerability
ghsa·2023-10-06
CVE-2023-26153 [CRITICAL] CWE-502 geokit-rails Command Injection vulnerability
geokit-rails Command Injection vulnerability
Versions of the package geokit-rails before 2.5.0 are vulnerable to Command Injection due to unsafe deserialisation of YAML within the 'geo_location' cookie. This issue can be exploited remotely via a malicious cookie value.
**Note:**
An attacker can use this vulnerability to execute commands on the host system.
OSV
geokit-rails Command Injection vulnerability
osv·2023-10-06
CVE-2023-26153 [CRITICAL] geokit-rails Command Injection vulnerability
geokit-rails Command Injection vulnerability
Versions of the package geokit-rails before 2.5.0 are vulnerable to Command Injection due to unsafe deserialisation of YAML within the 'geo_location' cookie. This issue can be exploited remotely via a malicious cookie value.
**Note:**
An attacker can use this vulnerability to execute commands on the host system.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://gist.github.com/CalumHutton/b7aa1c2e71c8d4386463ac14f686901dhttps://github.com/geokit/geokit-rails/blob/master/lib/geokit-rails/ip_geocode_lookup.rb%23L37https://github.com/geokit/geokit-rails/commit/7ffc5813e57f6f417987043e1039925fd0865c43https://github.com/geokit/geokit-rails/commit/a93dfe49fb9aeae7164e2f8c4041450a04b5482fhttps://security.snyk.io/vuln/SNYK-RUBY-GEOKITRAILS-5920323https://gist.github.com/CalumHutton/b7aa1c2e71c8d4386463ac14f686901dhttps://github.com/geokit/geokit-rails/blob/master/lib/geokit-rails/ip_geocode_lookup.rb%23L37https://github.com/geokit/geokit-rails/commit/7ffc5813e57f6f417987043e1039925fd0865c43https://github.com/geokit/geokit-rails/commit/a93dfe49fb9aeae7164e2f8c4041450a04b5482fhttps://security.snyk.io/vuln/SNYK-RUBY-GEOKITRAILS-5920323
2023-10-06
Published