Remote Code Execution: JSON parsing vulnerabilities CVE-2013-0333 and CVE-2013-0269

ID

ruby.checkjsonparsing

Severity

critical

Resource

Remote Code Execution

Language

Ruby

Description

Improper neutralization of directives in dynamically evaluated code ('Eval Injection').

Code Injection vulnerabilities occur when an application dynamically executes code containing untrusted input from users.

Rationale

Checks for JSON parsing vulnerabilities CVE-2013-0333 and CVE-2013-0269

Remediation

To mitigate Code Injection vulnerabilities, follow these best practices:

  1. Avoid Dynamic Code Execution: Where possible, avoid using dynamic script execution or reflection with untrusted input.

  2. Input Validation and Sanitization: Assume all input is potentially malicious. Rigorously validate all user inputs to confirm they adhere to expected formats, and sanitize them (a whitelisting approach is recommended) to remove potentially harmful content.

  3. Canonicalization: Decode and canonicalize inputs to a standard internal representation before validation. This helps prevent bypassing input filters through encoding tricks

Configuration

This detector does not need any configuration.

References