HTTP: Ruby on Rails XML Parameter Parsing Remote Code Execution

This signature detects attempts to exploit a known vulnerability against applications developed using Ruby on Rails. A successful attack can lead to arbitrary code execution.

Extended Description

active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.

Affected Products

Rubyonrails ruby_on_rails

References

BugTraq: 57187

CVE: CVE-2013-0156

URL: https://community.rapid7.com/community/metasploit/blog/2013/01/09/serialization-mischief-in-ruby-land-cve-2013-0156 http://weblog.rubyonrails.org/2013/1/8/rails-3-2-11-3-1-10-3-0-19-and-2-3-15-have-been-released/

Short Name

HTTP:RUBYONRAILS-XMLYAML-RCE

Severity

Critical

Recommended

False

Recommended Action

Drop

HTTP: Ruby on Rails XML Parameter Parsing Remote Code Execution

Extended Description

Affected Products

References

Found a potential security threat?