CVE-2023-26153.yml

---
gem: geokit-rails
cve: 2023-26153
ghsa: 7xvc-v44j-46fh
url: https://github.com/advisories/GHSA-7xvc-v44j-46fh
title: geokit-rails Command Injection vulnerability
date: 2023-10-06
description: |
  Versions of the package geokit-rails before 2.5.0 are vulnerable
  to Command Injection due to unsafe deserialisation of YAML within
  the 'geo_location' cookie. This issue can be exploited remotely
  via a malicious cookie value.

  **Note:**

   An attacker can use this vulnerability to execute commands
   on the host system.
cvss_v3: 8.3
patched_versions:
  - ">= 2.5.0"
related:
  url:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-26153
    - https://gist.github.com/CalumHutton/b7aa1c2e71c8d4386463ac14f686901d
    - https://github.com/geokit/geokit-rails/commit/7ffc5813e57f6f417987043e1039925fd0865c43
    - https://github.com/geokit/geokit-rails/commit/a93dfe49fb9aeae7164e2f8c4041450a04b5482f
    - https://github.com/geokit/geokit-rails/blob/master/lib/geokit-rails/ip_geocode_lookup.rb#L37
    - https://security.snyk.io/vuln/SNYK-RUBY-GEOKITRAILS-5920323
    - https://github.com/advisories/GHSA-7xvc-v44j-46fh