CVE-2013-1800 (published 2013-04-09T20:55Z)

The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Weakness information:
cwe_id: CWE-264
cwe_name: Permissions, Privileges, and Access Controls
description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Fix information:
repo_url: https://github.com/jnunemaker/crack
commit_details: repo_url: https://github.com/jnunemaker/crack
author: John Nunemaker
author_date: 2013-01-09 12:24:57-05:00
msg: Remove support for symbol and yaml.
repository: repo_url: https://github.com/jnunemaker/crack
repo_name: jnunemaker/crack
description: Really simple JSON and XML parsing, ripped from Merb and Rails.
repo_language: Ruby
owner: jnunemaker
file_changes: filename: xml.rb
change_type: ModificationType.MODIFY
diff: @@ -40,9 +40,7 @@ class REXMLUtilityNode #:nodoc:
   self.typecasts["decimal"]       = lambda{|v| v.nil? ? nil : BigDecimal(v.to_s)}
   self.typecasts["double"]        = lambda{|v| v.nil? ? nil : v.to_f}
   self.typecasts["float"]         = lambda{|v| v.nil? ? nil : v.to_f}
-  self.typecasts["symbol"]        = lambda{|v| v.nil? ? nil : v.to_sym}
   self.typecasts["string"]        = lambda{|v| v.to_s}
-  self.typecasts["yaml"]          = lambda{|v| v.nil? ? nil : YAML.load(v)}
   self.typecasts["base64Binary"]  = lambda{|v| v.unpack('m').first }
 
   self.available_typecasts = self.typecasts.keys

programming_language: Ruby
filename: xml_test.rb
change_type: ModificationType.MODIFY
diff: @@ -65,10 +65,10 @@ class XmlTest < Test::Unit::TestCase
         }
       }
     }
-    
+
     Crack::XML.parse(xml).should == hash
   end
-  
+
   context "Parsing xml with text and attributes" do
     setup do
       xml =<<-XML
@@ -90,20 +90,20 @@ class XmlTest < Test::Unit::TestCase
         }
       }
     end
-    
+
     should "be parse attributes for text node if present" do
       @data['opt']['user'][0].attributes.should == {'login' => 'grep'}
     end
-    
+
     should "default attributes to empty hash if not present" do
       @data['opt']['user'][1].attributes.should == {}
     end
-    
+
     should "add 'attributes' accessor methods to parsed instances of String" do
       @data['opt']['user'][0].respond_to?(:attributes).should be(true)
       @data['opt']['user'][0].respond_to?(:attributes=).should be(true)
     end
-    
+
     should "not add 'attributes' accessor methods to all instances of String" do
       "some-string".respond_to?(:attributes).should be(false)
       "some-string".respond_to?(:attributes=).should be(false)
@@ -149,7 +149,7 @@ class XmlTest < Test::Unit::TestCase
       Crack::XML.parse(xml)['tag'].should =~ Regexp.new(k)
     end
   end
-  
+
   should "should unescape XML entities in attributes" do
     xml_entities.each do |k,v|
       xml = "<tag attr='Some content #{v}'></tag>"
@@ -226,7 +226,6 @@ class XmlTest < Test::Unit::TestCase
         <approved type="boolean"></approved>
         <written-on type="date"></written-on>
         <viewed-at type="datetime"></viewed-at>
-        <content type="yaml"></content>
         <parent-id></parent-id>
       </topic>
     EOT
@@ -237,7 +236,6 @@ class XmlTest < Test::Unit::TestCase
       'approved'   => nil,
       'written_on' => nil,
       'viewed_at'  => nil,
-      'content'    => nil,
       'parent_id'  => nil
     }
     Crack::XML.parse(topic_xml)["topic"].should == expected_topic_hash
@@ -254,7 +252,6 @@ class XmlTest < Test::Unit::TestCase
         <replies-close-in type="integer">2592000000</replies-close-in>
         <written-on type="date">2003-07-16</written-on>
         <viewed-at type="datetime">2003-07-16T09:28:00+0000</viewed-at>
-        <content type="yaml">--- \n1: should be an integer\n:message: Have a nice day\narray: \n- should-have-dashes: true\n  should_have_underscores: true\n</content>
         <author-email-address>david@loudthinking.com</author-email-address>
         <parent-id></parent-id>
         <ad-revenue type="decimal">1.5</ad-revenue>
@@ -272,15 +269,11 @@ class XmlTest < Test::Unit::TestCase
       'replies_close_in' => 2592000000,
       'written_on' => Date.new(2003, 7, 16),
       'viewed_at' => Time.utc(2003, 7, 16, 9, 28),
-      # Changed this line where the key is :message.  The yaml specifies this as a symbol, and who am I to change what you specify
-      # The line in ActiveSupport is
-      # 'content' => { 'message' => "Have a nice day", 1 => "should be an integer", "array" => [{ "should-have-dashes" => true, "should_have_underscores" => true }] },
-      'content' => { :message => "Have a nice day", 1 => "should be an integer", "array" => [{ "should-have-dashes" => true, "should_have_underscores" => true }] },
       'author_email_address' => "david@loudthinking.com",
       'parent_id' => nil,
       'ad_revenue' => BigDecimal("1.50"),
       'optimum_viewing_angle' => 135.0,
-      'resident' => :yes
+      'resident' => 'yes',
     }
 
     Crack::XML.parse(topic_xml)["topic"].each do |k,v|
@@ -487,13 +480,13 @@ class XmlTest < Test::Unit::TestCase
 
     Crack::XML.parse(xml_string)['person'].should == expected_hash
   end
-  
+
   should "handle an empty xml string" do
     Crack::XML.parse('').should == {}
   end
-  
+
   # As returned in the response body by the unfuddle XML API when creating objects
   should "handle an xml string containing a single space" do
     Crack::XML.parse(' ').should == {}
   end
-end
\ No newline at end of file
+end

programming_language: Ruby