high7.5Public exploit code
CVE-2013-5036
The Square Squash allows remote attackers to execute arbitrary code via a YAML document in the (1) namespace parameter to the deobfuscation function or (2) sou…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Squash - YAML Code Execution (Metasploit)2013-08-12 · remote · multiple · Verified
Impact
The Square Squash allows remote attackers to execute arbitrary code via a YAML document in the (1) namespace parameter to the deobfuscation function or (2) sourcemap parameter to the sourcemap function in app/controllers/api/v1_controller.rb.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Squash | Square Squash | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- http://ceriksen.com/2013/08/06/squash-remote-code-execution-vulnerability-advisory/
- http://osvdb.org/95992
- http://www.exploit-db.com/exploits/27530
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86335
- https://github.com/SquareSquash/web/commit/6d667c19e96e4f23dccbfbe24afeebd18e98e1c5
- http://ceriksen.com/2013/08/06/squash-remote-code-execution-vulnerability-advisory/
- http://osvdb.org/95992
- http://www.exploit-db.com/exploits/27530
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86335
- https://github.com/SquareSquash/web/commit/6d667c19e96e4f23dccbfbe24afeebd18e98e1c5