CVE-2013-6414

Rails < 4.0.1 - Improper Input Validation

Title source: rule

Description

actionpack/lib/action_view/lookup_context.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to cause a denial of service (memory consumption) via a header containing an invalid MIME type that leads to excessive caching.

Exploits (1)

metasploit WORKING POC
by Toby Hsieh, joev, sinn3r · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/rails_action_view.rb

References (13)

Scores

EPSS 0.7084
EPSS Percentile 98.7%

Details

CWE
CWE-20
Status published
Products (22)
rubygems/actionpack 3.0.0 - 3.2.16RubyGems
rubyonrails/rails 4.0.0 (4 CPE variants)
rubyonrails/rails 4.0.1 rc1
rubyonrails/rails 3.0.0 (7 CPE variants)
rubyonrails/rails 3.0.1 (2 CPE variants)
rubyonrails/rails 3.0.2 (2 CPE variants)
rubyonrails/rails 3.0.3
rubyonrails/rails 3.0.4 rc1
rubyonrails/rails 3.0.5 (2 CPE variants)
rubyonrails/rails 3.0.6 (3 CPE variants)
... and 12 more
Published Dec 07, 2013
Tracked Since Feb 18, 2026