#Vulnerabilities Ruby on Rails XML Processor YAML Deserialization Code Execution: #Hacking #Security

Ruby on Rails XML Processor YAML Deserialization Code Execution

#Vulnerabilities Ruby on Rails XML Processor YAML Deserialization Code Execution: #Hacking #Security

active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion. ID: CVE-2013-0156 Vendor: rubyonrails.org CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

Full article: http://www.net-security.org/vuln.php?id=16357

Tweets

@cybsmith_flynn » 22 Jan '13, 6pm
RT @binushacker: #Vulnerabilities Ruby on Rails XML Processor YAML Deserialization Code Execution: [link] #Hacking #Security
@binushacker » 22 Jan '13, 6pm
#Vulnerabilities Ruby on Rails XML Processor YAML Deserialization Code Execution: [link] #Hacking #Security
@AnonNewsSEC » 22 Jan '13, 6pm
Ruby on Rails XML Processor YAML Deserialization Code Execution [link] #Vulnerabilities
@HNSVuln » 22 Jan '13, 6pm
Ruby on Rails XML Processor YAML Deserialization Code Execution: [link]
@zauberstuhl » 22 Jan '13, 6pm
Ruby on Rails XML Processor YAML Deserialization Code Execution [link]
@praamana » 22 Jan '13, 6pm
RT @binushacker: #Vulnerabilities Ruby on Rails XML Processor YAML Deserialization Code Execution: [link] #Hacking #Security
@Back5nux » 22 Jan '13, 6pm
RT @binushacker: #Vulnerabilities Ruby on Rails XML Processor YAML Deserialization Code Execution: [link] #Hacking #Security

Ruby on Rails XML Processor YAML Deserialization Code Execution

#Vulnerabilities Ruby on Rails XML Processor YAML Deserialization Code Execution: #Hacking #Security

Tweets

Vulnerability in JSON Parser in Ruby on Rails 3...

Vulnerability in JSON Parser in Ruby on Rails 3...

Ruby on Rails JSON Processor YAML Deserializati...

[remote] - Ruby on Rails JSON Processor YAML De...

#Vulnerabilities Ruby on Rails JSON Processor Y...

Ruby on Rails JSON Processor YAML Deserializati...

Django: 16 vulnerabilities. DoS, XSS, CSRF. Rai...

【検証レポート】【NTTデータ先端技術】Ruby on Rails の Action Pack...

Double Shot #1049

[Honeypot Alert] Active Probes for Ruby on Rail...

ModSecurity Mitigations for Ruby on Rails XML E...

Ruby on Rails Study Guide: The History of Rails

Django: 16 vulnerabilities. DoS, XSS, CSRF. Rai...

Il reste encore des places pour notre formation...

YAML's security woes are way bigger than Rails ...