CVE-2013-0156: Input Validation

The Ruby on Rails project reports:

Multiple vulnerabilities in parameter parsing in ActionPack

There are multiple weaknesses in the parameter parsing code for Ruby on Rails which could allow attackers to bypass authentication systems, inject arbitrary SQL, inject an execute arbitrary code, or perform a DoS attack on a rails application. This vulnerability has been assigned the CVE identifier CVE-2013-0156.

Versions Affected: ALL versions Not affected: NONE Fixed Versions: 3.2.11, 3.1.10, 3.0.19, 2.3.15

Impact ------ The XML parameter parsing code of Ruby on Rails allows applications to automatically to cast values from strings to certain data types. Unfortunately the type casting code supported certain conversions which were not suitable for performing on user-provided data including. This unsuitable conversion can be used by an attacker to compromise a rails application.

Due to the serious nature of this vulnerability, and the fact it has been disclosed publicly, all users running an affected release should either upgrade or use one of the work arounds immediately.

Releases -------- The FIXED releases are available at the normal locations.

Workarounds ----------- The work arounds differ depending on the rails version you are using. It involves disabling the YAML and Symbol type conversion from the Rails XML parser. You should place one of the following code snippets in an application initializer to ensure your application isn't vulnerable.

Rails 3.2, 3.1, 3.0 ---------

ActiveSupport::XmlMini::PARSING.delete("symbol") ActiveSupport::XmlMini::PARSING.delete("yaml")

Rails 2.3 ---------

ActiveSupport::CoreExtensions::Hash::Conversions::XMLPARSING.delete('symbol') ActiveSupport::CoreExtensions::Hash::Conversions::XMLPARSING.delete('yaml')