Object Injection Vulnerability in Ruby on Rails Affects Multiple Versions
CVE-2013-0156
Key Information:
- Vendor
Rubyonrails
- Status
- Vendor
- CVE Published:
- 13 January 2013
Badges
What is CVE-2013-0156?
The vulnerability in Ruby on Rails occurs due to insufficient restrictions on the casting of string values, enabling remote attackers to exploit this flaw through object-injection attacks. By leveraging Action Pack's support for YAML and Symbol type conversions, attackers can execute arbitrary code or trigger a denial-of-service condition through excessive memory and CPU consumption, often involving crafted nested XML entity references. The vulnerability affects multiple Ruby on Rails versions prior to their respective fixed releases, which must be updated to mitigate the associated risks.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.