The host is installed with Ruby on Rails and is prone to remote command execution vulnerability.

Successful exploitation could allow attackers to execute arbitrary commands. Impact Level: System/Application

Upgrade to Ruby on Rails 2.3.15, 3.0.19, 3.1.10, 3.2.11, or higher

Flaw is due to an error when parsing XML parameters, which allows symbol and yaml types to be a part of the request and can be exploited to execute arbitrary commands.

Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11

• http://blog.codeclimate.com/blog/2013/01/10/rails-remote-code-execution-vulnerability-explained
• http://osvdb.org/89026
• http://ronin-ruby.github.com/blog/2013/01/09/rails-pocs.html
• http://secunia.com/advisories/51753
• http://www.exploit-db.com/exploits/24019
• http://www.insinuator.net/2013/01/rails-yaml
• https://community.rapid7.com/community/metasploit/blog/2013/01/09/serialization-mischief-in-ruby-land-cve-2013-0156

---

Updated on 2015-03-25