Signature Detail

HTTP: Ruby on Rails XML Parameter Parsing Remote Code Execution

This signature detects attempts to exploit a known vulnerability against applications developed using Ruby on Rails. A successful attack can lead to arbitrary code execution.

Extended Description

active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.

Affected Products

• rubyonrails rails 1.2.4
• rubyonrails ruby_on_rails 0.10.0
• rubyonrails ruby_on_rails 0.10.1
• rubyonrails ruby_on_rails 0.11.0
• rubyonrails ruby_on_rails 0.11.1
• rubyonrails ruby_on_rails 0.12.0
• rubyonrails ruby_on_rails 0.12.1
• rubyonrails ruby_on_rails 0.13.0
• rubyonrails ruby_on_rails 0.13.1
• rubyonrails ruby_on_rails 0.14.1
• rubyonrails ruby_on_rails 0.14.2
• rubyonrails ruby_on_rails 0.14.3
• rubyonrails ruby_on_rails 0.14.4
• rubyonrails ruby_on_rails 0.5.0
• rubyonrails ruby_on_rails 0.5.5
• rubyonrails ruby_on_rails 0.5.6
• rubyonrails ruby_on_rails 0.5.7
• rubyonrails ruby_on_rails 0.6.0
• rubyonrails ruby_on_rails 0.6.5
• rubyonrails ruby_on_rails 0.7.0
• rubyonrails ruby_on_rails 0.8.0
• rubyonrails ruby_on_rails 0.8.5
• rubyonrails ruby_on_rails 0.9.0
• rubyonrails ruby_on_rails 0.9.1
• rubyonrails ruby_on_rails 0.9.2
• rubyonrails ruby_on_rails 0.9.3
• rubyonrails ruby_on_rails 0.9.4
• rubyonrails ruby_on_rails 0.9.4.1
• rubyonrails ruby_on_rails 1.0.0
• rubyonrails ruby_on_rails 1.1.0
• rubyonrails ruby_on_rails 1.1.1
• rubyonrails ruby_on_rails 1.1.2
• rubyonrails ruby_on_rails 1.1.3
• rubyonrails ruby_on_rails 1.1.4
• rubyonrails ruby_on_rails 1.1.5
• rubyonrails ruby_on_rails 1.1.6
• rubyonrails ruby_on_rails 1.2.0
• rubyonrails ruby_on_rails 1.2.1
• rubyonrails ruby_on_rails 1.2.2
• rubyonrails ruby_on_rails 1.2.3
• rubyonrails ruby_on_rails 1.2.4
• rubyonrails ruby_on_rails 1.2.5
• rubyonrails ruby_on_rails 1.2.6
• rubyonrails ruby_on_rails 1.9.5
• rubyonrails ruby_on_rails 2.0.0 (rc1)
• rubyonrails ruby_on_rails 2.0.0 (rc2)
• rubyonrails ruby_on_rails 2.0.1
• rubyonrails ruby_on_rails 2.0.2
• rubyonrails ruby_on_rails 2.0.4
• rubyonrails ruby_on_rails 2.1
• rubyonrails ruby_on_rails 2.1.0
• rubyonrails ruby_on_rails 2.1.1
• rubyonrails ruby_on_rails 2.1.2
• rubyonrails ruby_on_rails 2.2.0
• rubyonrails ruby_on_rails 2.2.1
• rubyonrails ruby_on_rails 2.2.2
• rubyonrails ruby_on_rails 2.3.10
• rubyonrails ruby_on_rails 2.3.11
• rubyonrails ruby_on_rails 2.3.12
• rubyonrails ruby_on_rails 2.3.13
• rubyonrails ruby_on_rails 2.3.2
• rubyonrails ruby_on_rails 2.3.3
• rubyonrails ruby_on_rails 2.3.4
• rubyonrails ruby_on_rails 2.3.9
• rubyonrails ruby_on_rails 3.0.0 (beta)
• rubyonrails ruby_on_rails 3.0.0 (beta2)
• rubyonrails ruby_on_rails 3.0.0 (beta3)
• rubyonrails ruby_on_rails 3.0.0 (beta4)
• rubyonrails ruby_on_rails 3.0.0 (rc)
• rubyonrails ruby_on_rails 3.0.0 (rc2)
• rubyonrails ruby_on_rails 3.0.10 (rc1)
• rubyonrails ruby_on_rails 3.0.11
• rubyonrails ruby_on_rails 3.0.12 (rc1)
• rubyonrails ruby_on_rails 3.0.13 (rc1)
• rubyonrails ruby_on_rails 3.0.14
• rubyonrails ruby_on_rails 3.0.16
• rubyonrails ruby_on_rails 3.0.17
• rubyonrails ruby_on_rails 3.0.1 (pre)
• rubyonrails ruby_on_rails 3.0.2 (pre)
• rubyonrails ruby_on_rails 3.0.3
• rubyonrails ruby_on_rails 3.0.4 (rc)
• rubyonrails ruby_on_rails 3.0.4 (rc1)
• rubyonrails ruby_on_rails 3.0.5 (rc1)
• rubyonrails ruby_on_rails 3.0.6 (rc1)
• rubyonrails ruby_on_rails 3.0.6 (rc2)
• rubyonrails ruby_on_rails 3.0.7 (rc1)
• rubyonrails ruby_on_rails 3.0.7 (rc2)
• rubyonrails ruby_on_rails 3.0.8 (rc1)
• rubyonrails ruby_on_rails 3.0.8 (rc2)
• rubyonrails ruby_on_rails 3.0.8 (rc3)
• rubyonrails ruby_on_rails 3.0.8 (rc4)
• rubyonrails ruby_on_rails 3.0.9 (rc1)
• rubyonrails ruby_on_rails 3.0.9 (rc2)
• rubyonrails ruby_on_rails 3.0.9 (rc3)
• rubyonrails ruby_on_rails 3.0.9 (rc4)
• rubyonrails ruby_on_rails 3.0.9 (rc5)
• rubyonrails ruby_on_rails 3.1.0 (beta1)
• rubyonrails ruby_on_rails 3.1.0 (rc1)
• rubyonrails ruby_on_rails 3.1.0 (rc2)
• rubyonrails ruby_on_rails 3.1.0 (rc3)
• rubyonrails ruby_on_rails 3.1.0 (rc4)
• rubyonrails ruby_on_rails 3.1.0 (rc5)
• rubyonrails ruby_on_rails 3.1.0 (rc6)
• rubyonrails ruby_on_rails 3.1.0 (rc7)
• rubyonrails ruby_on_rails 3.1.0 (rc8)
• rubyonrails ruby_on_rails 3.1.1 (rc1)
• rubyonrails ruby_on_rails 3.1.1 (rc2)
• rubyonrails ruby_on_rails 3.1.1 (rc3)
• rubyonrails ruby_on_rails 3.1.2 (rc1)
• rubyonrails ruby_on_rails 3.1.2 (rc2)
• rubyonrails ruby_on_rails 3.1.3
• rubyonrails ruby_on_rails 3.1.4 (rc1)
• rubyonrails ruby_on_rails 3.1.5 (rc1)
• rubyonrails ruby_on_rails 3.1.6
• rubyonrails ruby_on_rails 3.1.7
• rubyonrails ruby_on_rails 3.1.8
• rubyonrails ruby_on_rails 3.2.0 (rc1)
• rubyonrails ruby_on_rails 3.2.0 (rc2)
• rubyonrails ruby_on_rails 3.2.1
• rubyonrails ruby_on_rails 3.2.2 (rc1)
• rubyonrails ruby_on_rails 3.2.3 (rc1)
• rubyonrails ruby_on_rails 3.2.3 (rc2)
• rubyonrails ruby_on_rails 3.2.4 (rc1)
• rubyonrails ruby_on_rails 3.2.5
• rubyonrails ruby_on_rails 3.2.6
• rubyonrails ruby_on_rails 3.2.7
• rubyonrails ruby_on_rails 3.2.8
• rubyonrails ruby_on_rails 3.2.9
• rubyonrails ruby_on_rails up to 2.3.14
• rubyonrails ruby_on_rails up to 3.0.18
• rubyonrails ruby_on_rails up to 3.1.9
• rubyonrails ruby_on_rails up to 3.2.10

References

• BugTraq: 57187
• CVE: CVE-2013-0156