Description
lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rails | 2.3.14.1 | — |
| Debian 13 | rails | 2.3.14.1 | — |
| Debian 12 | rails | 2.3.14.1 | — |
| Debian 6.0 | rails | 2.3.5-1.2+squeeze6 | DSA-2613-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 1 | rubygem-activesupport | 1:3.0.13-4.el6op | RHSA-2013:0202 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 2 modules
-
Ruby on Rails JSON Processor YAML Deserialization Code Execution
exploit/multi/http/rails_json_yaml_code_exec
-
Ruby on Rails JSON Processor YAML Deserialization Scanner
auxiliary/scanner/http/rails_json_yaml_scanner
Exploit-DB 1
- Ruby on Rails - JSON Processor YAML Deserialization Code Execution (Metasploit) EDB-24434 · remote · Jan 29, 2013 · verified
GitHub 1 repository
-
heroku/heroku-CVE-2013-0333 ★ 2 · Jan 29, 2013
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | activesupport | >= 2.3.2, < 2.3.16 | 2.3.16 | GHSA-xgr2-v94m-rc9g |
| RubyGems | activesupport | >= 3.0.0, < 3.0.20 | 3.0.20 | GHSA-xgr2-v94m-rc9g |
Advisories 2
- DSA-2613-1 rails - insufficient input validation Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2013:0202 Red Hat Security Advisory: rubygem-activesupport security update Red Hat Security Advisories (RHSA) · Jan 29, 2026
References
- VU#628463 third-party-advisory
- DSA-2613 vendor-advisory
- http://support.apple.com/kb/HT5784
- APPLE-SA-2013-06-04-1 vendor-advisory
- APPLE-SA-2013-03-14-1 vendor-advisory
- [rubyonrails-security] 20130129 Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3 mailing-list
- RHSA-2013:0201 vendor-advisory
- RHSA-2013:0202 vendor-advisory
- https://puppet.com/security/cve/cve-2013-0333
- http://weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released/
- RHSA-2013:0203 vendor-advisory