CVE-2013-0156
EXPLOITEDRuby on Rails JSON Processor YAML Deserialization Code Execution
Title source: metasploitExploitation Summary
CVE-2013-0156 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 15 public exploits from researchers including Metasploit, bsodmike, heroku, including a Metasploit module exploits/multi/http/rails_json_yaml_code_exec.
AI-analyzed exploit summary This exploit leverages a known secret token in Ruby on Rails applications to achieve remote code execution via deserialization of a crafted Ruby object in session cookies. It supports both Rails 3 and Rails 4 by generating signed or encrypted cookies containing malicious payloads.
Description
active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
Exploits (15)
This exploit leverages a known secret token in Ruby on Rails applications to achieve remote code execution via deserialization of a crafted Ruby object in session cookies. It supports both Rails 3 and Rails 4 by generating signed or encrypted cookies containing malicious payloads.
This Metasploit module exploits CVE-2013-0156, a YAML deserialization vulnerability in Ruby on Rails, allowing remote code execution via crafted XML requests. It targets both Rails 2.x and 3.x by embedding malicious YAML payloads in XML data.
This repository demonstrates CVE-2013-0156, a Ruby on Rails XML parameter parsing vulnerability leading to remote code execution. The exploit leverages unsafe YAML deserialization in Rails' parameter parsing to execute arbitrary code.
This repository contains a Ruby script that scans Heroku applications for vulnerable Rails versions affected by CVE-2013-0156. It checks the installed Rails version against a list of patched versions and flags applications that are potentially vulnerable.
This is a functional exploit for CVE-2013-0156, a YAML deserialization vulnerability in Ruby on Rails. It leverages unsafe object deserialization to achieve remote code execution (RCE) by crafting malicious YAML payloads sent via HTTP POST requests.
This is a Python-based exploit for CVE-2013-0156, targeting a YAML deserialization vulnerability in Ruby on Rails (2.x and 3.x) to achieve remote code execution (RCE). The script crafts a malicious YAML payload embedded in XML and sends it to the target URL, leveraging insecure deserialization.
This PoC exploits CVE-2013-0156, a Ruby on Rails YAML deserialization vulnerability, to achieve remote command execution. It encodes commands in base64, sends them via a crafted XML/YAML payload, and retrieves output from attacker-controlled logs.
This PoC exploits a Ruby on Rails YAML deserialization vulnerability (CVE-2013-0156) to achieve remote code execution. It crafts a malicious YAML payload embedded in XML, which triggers arbitrary command execution when processed by a vulnerable Rails application.
This repository contains a proof-of-concept exploit for CVE-2013-0156, which involves a vulnerability in the Ruby JSON gem. The exploit leverages the unsafe use of YAML.load in the Crack library to achieve remote code execution.
This repository demonstrates CVE-2013-0156, a Ruby on Rails JSON parameter parsing vulnerability. The `PagesController` exposes a `reverse` action that processes user input via `params[:name].reverse!`, which can be exploited to achieve remote code execution due to unsafe parameter parsing in Rails.
This Metasploit module exploits a YAML deserialization vulnerability in Ruby on Rails (CVE-2013-0333) by embedding malicious YAML in JSON requests, leading to remote code execution. It supports Rails 2.x and 3.x by crafting payloads that trigger arbitrary Ruby code execution via the `eval` function.
This Metasploit module scans for Ruby on Rails instances vulnerable to CVE-2013-0156 by sending crafted JSON/YAML payloads and analyzing response codes to detect deserialization flaws.
This Metasploit auxiliary module scans for Ruby on Rails instances vulnerable to CVE-2013-0156, a YAML deserialization flaw in the XML processor. It sends XML probes with YAML payloads to detect differential responses indicating vulnerability.
This Metasploit module exploits a known secret session cookie vulnerability in Ruby on Rails (CVE-2013-0156) to achieve remote code execution via deserialization of a crafted Ruby object. It supports Rails 3 and 4 by leveraging the application's secret token or key base to sign malicious session cookies.
This Metasploit module exploits CVE-2013-0156, a YAML deserialization vulnerability in Ruby on Rails (RoR) 2.x and 3.x, allowing remote code execution via crafted XML requests containing malicious YAML payloads. The exploit leverages the `eval` function to execute arbitrary Ruby code in the context of the target application.