CVE-2013-0156

CVE-2013-0156 is a critical object-injection vulnerability in Ruby on Rails versions prior to 2.3.15, 3.0.19, 3.1.10, and 3.2.11, affecting the active_support/core_ext/hash/conversions.rb component. This flaw allows remote attackers to execute arbitrary code or cause a denial of service through improper string value casting, leveraging YAML or Symbol type conversion. With a CVSS score of 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P), it represents a high-severity risk, indicating that it can be exploited remotely with low complexity and without authentication, leading to partial confidentiality, integrity, and availability impacts. The vulnerability has known Metasploit modules for exploitation, including remote code execution, and has garnered significant community discussion and media coverage, with reports of active exploitation in the wild, such as the RubyMiner malware.