Description
active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rails | 2.3.14.1 | — |
| Debian 13 | rails | 2.3.14.1 | — |
| Debian 12 | rails | 2.3.14.1 | — |
| Debian 6.0 | rails | 2.3.5-1.2+squeeze4.1 | DSA-2604-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 1 | ruby193-rubygem-actionpack +1 | 1:3.2.8-2.el6 | RHSA-2013:0153 |
| Red Hat OpenShift 1 | ruby193-rubygem-activesupport | 1:3.2.8-3.el6 | RHSA-2013:0153 |
| Red Hat OpenShift 1 | rubygem-actionpack | 1:3.0.13-2.1.el6op | RHSA-2013:0153 |
| Red Hat OpenShift 1 | rubygem-activesupport | 1:3.0.13-2.el6op | RHSA-2013:0153 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | rubygem-extlib | 0.9.16-7.4 | openSUSE-SU-2024:10188-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 3 modules
-
Ruby on Rails XML Processor YAML Deserialization Code Execution
exploit/multi/http/rails_xml_yaml_code_exec
-
Ruby on Rails XML Processor YAML Deserialization Scanner
auxiliary/scanner/http/rails_xml_yaml_scanner
-
Ruby on Rails Known Secret Session Cookie Remote Code Execution
exploit/multi/http/rails_secret_deserialization
Exploit-DB 2
- Ruby on Rails - Known Secret Session Cookie Remote Code Execution (Metasploit) EDB-27527 · remote · Aug 12, 2013 · verified
- Ruby on Rails - XML Processor YAML Deserialization Code Execution (Metasploit) EDB-24019 · remote · Jan 10, 2013 · verified
GitHub 8 repositories
-
bsodmike/rails-exploit-cve-2013-0156 ★ 5 · Jan 12, 2013
Bootstrapped Rails 3.2.10 to test the remote code exploit CVE-2013-0156
-
heroku/heroku-CVE-2013-0156 ★ 1 · Jan 11, 2013
Inspect all of your heroku apps to see if they are running a vulnerable version of Rails
-
7s26simon/CVE-2013-0156 ★ 0 · Dec 11, 2025
Modified ruby script for RCE
-
oxben10/CVE-2013-0156 ★ 0 · Nov 13, 2024
This script is specifically designed to solve the challenge on PentesterLab for the CVE-2013-0156 exploit
-
Jjdt12/kuang_grade_mk11 ★ 0 · Jul 29, 2023
Pseudo shell for CVE-2013-0156.
-
R3dKn33-zz/CVE-2013-0156 ★ 0 · May 27, 2019
Arbitrary deserialization that can be used to trigger SQL injection and even Code execution
-
josal/crack-0.1.8-fixed ★ 0 · Jan 11, 2013
crack repo from jnunemaker but with version 0.1.8 and rails CVE-2013-0156 vulnerability fixed
-
terracatta/name_reverser ★ 0 · Jan 10, 2013
Silly Rails App to demonstrate vuln CVE-2013-0156
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | actionpack | < 2.3.15 | 2.3.15 | GHSA-jmgw-6vjg-jjwg |
| RubyGems | actionpack | >= 3.0.0, < 3.0.19 | 3.0.19 | GHSA-jmgw-6vjg-jjwg |
| RubyGems | actionpack | >= 3.1.0, < 3.1.10 | 3.1.10 | GHSA-jmgw-6vjg-jjwg |
| RubyGems | actionpack | >= 3.2.0, < 3.2.11 | 3.2.11 | GHSA-jmgw-6vjg-jjwg |
Advisories 3
- RHSA-2013:0153 Red Hat Security Advisory: Ruby on Rails security update Red Hat Security Advisories (RHSA) · Mar 27, 2026
- DSA-2604-1 rails - insufficient input validation Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10188-1 ruby2.2-rubygem-extlib-0.9.16-7.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- [rubyonrails-security] 20130108 Multiple vulnerabilities in parameter parsing in Action Pack (CVE-2013-0156) mailing-list
- http://www.insinuator.net/2013/01/rails-yaml/
- RHSA-2013:0155 vendor-advisory
- VU#628463 third-party-advisory
- https://community.rapid7.com/community/metasploit/blog/2013/01/09/serialization-mischief-in-ruby-land-cve-2013-0156
- http://www.fujitsu.com/global/support/software/security/products-f/sw-sv-rcve-ror201301e.html
- VU#380039 third-party-advisory
- APPLE-SA-2013-03-14-1 vendor-advisory
- DSA-2604 vendor-advisory
- http://ics-cert.us-cert.gov/advisories/ICSA-13-036-01A
- RHSA-2013:0154 vendor-advisory
- https://puppet.com/security/cve/cve-2013-0156
- http://weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released/
- RHSA-2013:0153 vendor-advisory