Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
Priority
MEDIUM
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 3 products
The story here is insecure YAML deserialization in a core framework component. We reproduced the public RCE in Rails `actionpack`, CVE-2013-0156. Exploit built and patch verified as closed in 3m 46s for $0.44.
Post summary
A proof‑of‑concept remote code execution exploit for CVE‑2013‑0156 in Rails actionpack was reconstructed, and a patch was verified to close the issue.
4 of 4 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | debian | debian_linux | 6.0 | - | - |
| OS | debian | debian_linux | 7.0 | - | - |
| App | rubyonrails | rails | - | - | - |
| App | rubyonrails | ruby_on_rails | - | - | - |