CVE-2013-6414
Ruby on Rails 3.x < 3.2.16 and 4.x < 4.0.2 - Denial of Service via Invalid MIME Type Header
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2013-6414.
PoCs published by Toby Hsieh, joev, sinn3r, including Metasploit module auxiliary/dos/http/rails_action_view.
AI-analyzed exploit summary This Metasploit module exploits a Denial of Service (DoS) vulnerability in Ruby on Rails Action View by sending crafted HTTP requests with large 'Accept' headers to exhaust server memory. It targets versions 3.0.0 and later, fixed in 4.0.2 and 3.2.16.
Description
actionpack/lib/action_view/lookup_context.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to cause a denial of service (memory consumption) via a header containing an invalid MIME type that leads to excessive caching.
Exploits (1)
This Metasploit module exploits a Denial of Service (DoS) vulnerability in Ruby on Rails Action View by sending crafted HTTP requests with large 'Accept' headers to exhaust server memory. It targets versions 3.0.0 and later, fixed in 4.0.2 and 3.2.16.