PT-2013-1054 · Ruby+1 · Ruby On Rails+1

Lawrence Pit · Published 2013-01-30 · Updated 2023-02-13 · CVE-2013-0333

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Ruby on Rails versions 2.3.x through 2.3.15 Ruby on Rails versions 3.0.x through 3.0.19

Description The issue affects the confidentiality, integrity, and availability of protected information. It can be exploited remotely. The problem lies in the lib/active support/json/backends/yaml.rb file, which does not properly convert JSON data to YAML data for processing by a YAML parser. This allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding.

Recommendations For Ruby on Rails versions 2.3.x through 2.3.15, update to version 2.3.16 or later. For Ruby on Rails versions 3.0.x through 3.0.19, update to version 3.0.20 or later. As a temporary workaround, consider disabling the lib/active support/json/backends/yaml.rb file until a patch is available. Restrict access to the vulnerable YAML parser to minimize the risk of exploitation. Avoid using crafted data that triggers unsafe decoding in the affected API endpoints until the issue is resolved.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

BDU:2015-01308

CVE-2013-0333

DSA-2613-1

GHSA-XGR2-V94M-RC9G

OPENSUSE-SU-2013_0278-1

OPENSUSE-SU-2013_0280-1

RAILSJSONYAMLRCECHECK

RHSA-2013:0202

Affected Products

Ruby On Rails

Suse

References · 33

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/rails_secret_deserialization.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/rails_xml_yaml_code_exec.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/rails_json_yaml_scanner.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/rails_json_yaml_code_exec.rb · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2013-0333.yml · Exploit
• 🔥 https://github.com/bsodmike/rails-exploit-cve-2013-0156 · Exploit
• 🔥 https://exploit-db.com/exploits/24434 · Exploit
• https://groups.google.com/group/rubyonrails-security/msg/52179af76915e518?dmode=source&output=gplain · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0203.html · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0201.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-0333 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-0333 · Security Note
• https://osv.dev/vulnerability/GHSA-xgr2-v94m-rc9g · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html · Vendor Advisory