CVE-2013-1801 HTTParty does not restrict casts of string values
Remote attackers can execute arbitrary code or cause denial of service via unsafe YAML deserialization in the httparty Ruby gem.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-1801?
CVE-2013-1801 is a high-severity unsafe deserialization vulnerability in n/a, published on 9 Apr 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The httparty gem 0.9.0 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for YAML type conversion, a similar vulnerability to CVE-2013-0156.
Weakness: CWE-264
Which versions are affected by CVE-2013-1801?
2 open source packages ship an affected version, including httparty. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
httparty RubyGems | All versions | 0.10.0 |
httparty RubyGems | All versions | 0.10.0 |
Products include Jnunemaker Httparty.
How do I fix CVE-2013-1801?
Upgrade httparty to 0.10.0 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2013-1801 being exploited?
There is no known exploitation of CVE-2013-1801 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-mgx3-27hr-mfgp.