CVE-2013-0156 actionpack Improper Input Validation vulnerability
Remote attackers can execute arbitrary code or cause denial of service via unsafe YAML or Symbol deserialization in Ruby on Rails.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-0156?
CVE-2013-0156 is a high-severity unsafe deserialization vulnerability in Debian Debian Linux, published on 13 Jan 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
Weakness: CWE-20
Which versions are affected by CVE-2013-0156?
8 open source packages ship an affected version, including actionpack. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
actionpack RubyGems | All versions | 2.3.15 |
actionpack RubyGems | All versions | 2.3.15 |
actionpack RubyGems | From 3.0.0 | 3.0.19 |
actionpack RubyGems | From 3.0.0 | 3.0.19 |
actionpack RubyGems | From 3.1.0 | 3.1.10 |
actionpack RubyGems | From 3.1.0 | 3.1.10 |
2 more packages
actionpack RubyGems | From 3.2.0 | 3.2.11 |
actionpack RubyGems | From 3.2.0 | 3.2.11 |
Linux distribution packages (6)
ruby193-rubygem-actionpack Red Hat:openshift:1::el6 | All versions | 1:3.2.8-2.el6 |
ruby193-rubygem-actionpack-doc Red Hat:openshift:1::el6 | All versions | 1:3.2.8-2.el6 |
ruby193-rubygem-activesupport Red Hat:openshift:1::el6 | All versions | 1:3.2.8-3.el6 |
rubygem-actionpack Red Hat:openshift:1::el6 | All versions | 1:3.0.13-2.1.el6op |
rubygem-activesupport Red Hat:openshift:1::el6 | All versions | 1:3.0.13-2.el6op |
rubygem-extlib openSUSE:Tumbleweed | All versions | 0.9.16-7.4 |
Products include Debian Debian Linux, Rubyonrails Rails, Rubyonrails Ruby on Rails.
How do I fix CVE-2013-0156?
Upgrade actionpack to a fixed version for your release line: 2.3.15, 3.0.19, 3.1.10 or 3.2.11.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2013-0156 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2013-0156 exists.
Public exploit code: 3 Metasploit modules, 2 Exploit-DB entries and 8 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2013-0156, DSA-2604-1, GHSA-jmgw-6vjg-jjwg, RHSA-2013:0153, openSUSE-SU-2024:10188-1.