PT-2013-2146 · Ruby · Multi Xml+1
Fowlduck
·
Published
2013-04-25
·
Updated
2026-03-13
·
CVE-2013-0175
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
multi xml gem version 0.5.2
Grape versions prior to 0.2.6
Description
The issue allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service involving nested XML entity references. This can be achieved by leveraging support for YAML type conversion or Symbol type conversion.
Recommendations
For multi xml gem version 0.5.2, update to a version that properly restricts casts of string values.
For Grape versions prior to 0.2.6, update to version 0.2.6 or later to mitigate the risk of object-injection attacks and denial of service.
As a temporary workaround, consider disabling YAML type conversion and Symbol type conversion until a patch is available.
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Grape
Multi Xml