Arbitrary Code Injection Affecting activesupport package, versions < 3.0.20, >= 2.4 < 2.3.16

Snyk CVSS

Attack Complexity Low

Threat Intelligence

Exploit Maturity Mature

EPSS 97.39% (100^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-RUBY-ACTIVESUPPORT-20054
published 27 Jan 2013
disclosed 27 Jan 2013
credit Lawrence Pit

Report a new vulnerability Found a mistake?

Introduced: 27 Jan 2013

CVE-2013-0333 Open this link in a new tab CWE-94 Open this link in a new tab

Overview

activesupport is toolkit of support libraries and Ruby core extensions extracted from the Rails framework

Ruby on Rails contains a flaw in the JSON parser which may allow a remote attacker to bypass restrictions, allowing them to bypass authentication systems, inject arbitrary SQL, inject and execute arbitrary code, or perform a DoS attack on a Rails application.

Details

Rails supports multiple parsing backends, one of which involves transforming JSON into YAML via the YAML parser. With a specially crafted payload, an attacker can subvert the backend into decoding a subset of YAML. This may allow a remote attacker to bypass restrictions, allowing them to bypass authentication systems, inject arbitrary SQL, inject and execute arbitrary code, or perform a DoS attack on a Rails application.