7.5

CVE-2013-0156: debian debian_linux Improper Input Validation

CVSS: 7.5v2.0HighModified
AliasesRHSA-2013:0153UBUNTU-CVE-2013-0156DEBIAN-CVE-2013-0156
Published 13-01-2013Last modified 06-08-2024
Open JSON

Vulnerability summary

CVE-2013-0156 is a high (CVSS 7.5) Improper Input Validation vulnerability in debian debian_linux. EPSS estimates a 99.45% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 5 public exploits are recorded.

Overall risk
60/100
0100
High · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v2.0 (NVD)
EPSS score
99.45%
0%100%
Critical · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits5exploit-database, metasploit

Timeline

  1. 13-01-2013
    PublishedVulnerability first disclosed.
  2. 06-08-2024
    Last modifiedVulnerability information updated.

Description

active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

Probability

99.45%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 99.45% on 18-09-2026

18-09-202618-10-2026
EPSS score
99.45%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

5 found
  • exploit-databaseremotemultipleVerified

    Ruby on Rails - Known Secret Session Cookie Remote Code Execution (Metasploit)

    Maturity: weaponized

  • exploit-databaseremotemultipleVerified

    Ruby on Rails - XML Processor YAML Deserialization Code Execution (Metasploit)

    Maturity: weaponized

  • MetasploitMetasploitremoteUnverified

    Ruby on Rails XML Processor YAML Deserialization Scanner

    auxiliary/scanner/http/rails_xml_yaml_scanner

    Maturity: poc

Show all 5 exploits
  • MetasploitMetasploitremoteVerified

    Ruby on Rails Known Secret Session Cookie Remote Code Execution

    exploit/multi/http/rails_secret_deserialization

    Maturity: weaponized

  • MetasploitMetasploitremoteVerified

    Ruby on Rails XML Processor YAML Deserialization Code Execution

    exploit/multi/http/rails_xml_yaml_code_exec

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Redhat5 products
  • ruby193-rubygem-actionpack< 1:3.2.8-2.el6
  • ruby193-rubygem-actionpack-doc< 1:3.2.8-2.el6
  • ruby193-rubygem-activesupport< 1:3.2.8-3.el6
  • rubygem-actionpack< 1:3.0.13-2.1.el6op
  • rubygem-activesupport< 1:3.0.13-2.el6op
Debian2 products
  • rails< 2.3.14.1 | < 2.3.5-1.2+squeeze4.1
  • debian_linuxEOL6.0 | 7.0
Rubyonrails2 products
Opensuse1 product
  • rubygem-extlib&distro=openSUSE Tumbleweed< 0.9.16-7.4
RubyGems1 product
  • actionpack< 2.3.15 | ≥ 3.0.0, < 3.0.19 | ≥ 3.1.0, < 3.1.10 | ≥ 3.2.0, < 3.2.11
Ubuntu1 product
  • ruby-extlib< 0.9.15-3

6 vendors · 12 products

References

32 links
Show all 32 references