CVE-2013-1802

Vulnerability

The extlib gem versions 0.9.15 and earlier for Ruby does not properly restrict casts of string values. This flaw is related to YAML parameter parsing and Symbol type conversion, similar to CVE-2013-0156. The affected versions are extlib <= 0.9.15, with the fix released in version 0.9.16 [1], [3]. The vulnerability arises when Action Pack support is leveraged for type conversion, allowing untrusted input to be processed in an unsafe manner.

Exploitation

An attacker can conduct object-injection attacks by sending crafted YAML or Symbol data to an application that uses the extlib gem. No special network position is required beyond normal access to the application's input vectors. The attack relies on the application processing untrusted data via the vulnerable type conversion code. The specific steps involve providing malicious YAML or Symbol strings that, when deserialized, lead to arbitrary object instantiation.

Impact

Successful exploitation allows an attacker to execute arbitrary code on the server or cause a denial of service through excessive memory and CPU consumption. The attack can lead to full compromise of the confidentiality, integrity, and availability of the affected system [1].

Mitigation

The fix was released in extlib version 0.9.16, which is available on RubyGems [3]. Users should update the gem using bundle update extlib and ensure their Gemfile.lock references version 0.9.16 or later [3]. No workarounds are documented if the gem cannot be updated. The vulnerability is not known to be in the CISA KEV catalog.