Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2013-0156

EPSS 91.91% · P100
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2013-0156

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Ruby on Rails 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Ruby on Rails是美国Rails团队的一套基于Ruby语言的开源Web应用框架。 Ruby on Rails存在输入验证错误漏洞，该漏洞源于没有正确限制字符串值的转换 ，允许远程攻击者进行注入并执行任意代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Shenlong Deep Dive — AI Deep Analysis

10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.

Read summary Full analysis (login)

Affected Products

VendorProductAffected VersionsCPESubscribe
-n/a n/a -

II. Public POCs for CVE-2013-0156

#POC DescriptionSource LinkShenlong Link
1Silly Rails App to demonstrate vuln CVE-2013-0156https://github.com/terracatta/name_reverserPOC Details
2Inspect all of your heroku apps to see if they are running a vulnerable version of Railshttps://github.com/heroku/heroku-CVE-2013-0156POC Details
3crack repo from jnunemaker but with version 0.1.8 and rails CVE-2013-0156 vulnerability fixedhttps://github.com/josal/crack-0.1.8-fixedPOC Details
4Bootstrapped Rails 3.2.10 to test the remote code exploit CVE-2013-0156https://github.com/bsodmike/rails-exploit-cve-2013-0156POC Details
5Arbitrary deserialization that can be used to trigger SQL injection and even Code executionhttps://github.com/R3dKn33-zz/CVE-2013-0156POC Details
6Pseudo shell for CVE-2013-0156. https://github.com/Jjdt12/kuang_grade_mk11POC Details
7This script is specifically designed to solve the challenge on PentesterLab for the CVE-2013-0156 exploithttps://github.com/oxBEN10/CVE-2013-0156POC Details
8This script is specifically designed to solve the challenge on PentesterLab for the CVE-2013-0156 exploithttps://github.com/oxben10/CVE-2013-0156POC Details
9Infoblox NetMRI virtual appliances before version 7.6.1 are vulnerable to remote code execution (RCE) due to the use of a hardcoded Ruby on Rails session cookie secret key. The Rails web component deserializes session cookies if the signing key is valid. Attackers with knowledge of this key can craft malicious session cookies that are deserialized by the application, leading to arbitrary code execution. This vulnerability is related to the known Ruby on Rails deserialization flaw (CVE-2013-0156). Infoblox did not assign a new CVE for this issue, as it is a result of the underlying Rails vulnerability. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/infoblox/infoblox-netmri-rails-cookie-rce.yamlPOC Details
10Modified ruby script for RCEhttps://github.com/7s26simon/CVE-2013-0156POC Details
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2013-0156

请登录查看更多情报信息。

Same Patch Batch · n/a · 2013-01-13 · 29 CVEs total

CVE-2013-0757Mozilla Firefox/Thunderbird/SeaMonkey COW绕过权限提升漏洞
CVE-2013-0771Mozilla Firefox/Thunderbird/SeaMonkey 基于堆的缓冲区错误漏洞
CVE-2013-0770Mozilla Firefox/Thunderbird/SeaMonkey 内存破坏漏洞
CVE-2013-0769Mozilla Firefox/Thunderbird/SeaMonkey 内存破坏漏洞
CVE-2013-0768Mozilla Firefox/Thunderbird/SeaMonkey Canvas缓冲区错误漏洞
CVE-2013-0767Mozilla Firefox/Thunderbird/SeaMonkey 越界读取漏洞
CVE-2013-0766Mozilla Firefox/Thunderbird/SeaMonkey 释放后使用漏洞
CVE-2013-0764Mozilla Firefox/Thunderbird/SeaMonkey 任意代码执行漏洞
CVE-2013-0763Mozilla Firefox/Thunderbird/SeaMonkey Mesa释放后使用漏洞
CVE-2013-0762Mozilla Firefox/Thunderbird/SeaMonkey 释放后使用漏洞
CVE-2013-0761Mozilla Firefox/Thunderbird/SeaMonkey 释放后使用漏洞
CVE-2013-0760Mozilla Firefox/Thunderbird/SeaMonkey 缓冲区错误漏洞
CVE-2013-0759Mozilla Firefox/SeaMonkey/Thunderbird 地址栏欺骗漏洞
CVE-2013-0758Mozilla Firefox/Thunderbird/SeaMonkey 权限提升漏洞
CVE-2013-0155Ruby on Rails 不安全查询生成漏洞
CVE-2013-0756Mozilla Firefox/Thunderbird/SeaMonkey ‘obj_toSource’函数释放后使用漏洞
CVE-2013-0755Mozilla Firefox/Thunderbird/SeaMonkey Vibrate释放后使用漏洞
CVE-2013-0754Mozilla Firefox/Thunderbird/SeaMonkey 释放后使用漏洞
CVE-2013-0753Mozilla Firefox/Thunderbird/SeaMonkey ‘serializeToStream’释放后使用漏洞
CVE-2013-0752Mozilla Firefox/Thunderbird/SeaMonkey XBL处理内存破坏漏洞

Showing top 20 of 29 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: n/a
Same vendor: n/a

V. Comments for CVE-2013-0156

No comments yet

Leave a comment