Object Injection Vulnerability in Ruby on Rails Affects Multiple Versions
CVE-2013-0156

Currently unrated

Key Information:

Vendor: Rubyonrails
Status: Ruby On Rails; Rails
Vendor: CVE Published:; 13 January 2013

🔔 Create Rubyonrails Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 91%

What is CVE-2013-0156?

The vulnerability in Ruby on Rails occurs due to insufficient restrictions on the casting of string values, enabling remote attackers to exploit this flaw through object-injection attacks. By leveraging Action Pack's support for YAML and Symbol type conversions, attackers can execute arbitrary code or trigger a denial-of-service condition through excessive memory and CPU consumption, often involving crafted nested XML entity references. The vulnerability affects multiple Ruby on Rails versions prior to their respective fixed releases, which must be updated to mitigate the associated risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

rails-exploit-cve-2013-0156
Created by bsodmike

heroku-CVE-2013-0156
Created by heroku

CVE-2013-0156
Created by 7s26simon