Vulnerability record · CVE-2013-5036 · published 27 May 2014
CVE-2013-5036: Square Squash YAML deserialization code injection in API controller
Squash · Square Squash
Square Squash passes attacker-controlled YAML from the namespace and sourcemap parameters into deobfuscation and sourcemap functions in app/controllers/api/v1_controller.rb without safe loading. Because YAML deserialization can instantiate arbitrary objects, a remote attacker can achieve code execution on the server. The flaw is rated high severity (CVSS 2.0 7.5) and a public exploit exists.
Description
The Square Squash allows remote attackers to execute arbitrary code via a YAML document in the (1) namespace parameter to the deobfuscation function or (2) sourcemap parameter to the sourcemap function in app/controllers/api/v1_controller.rb.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityUnauthenticated remote code execution with a public exploit and very high EPSS score, though the product is niche and no KEV listing is present.
What it is
Square Squash passes attacker-controlled YAML from the namespace and sourcemap parameters into deobfuscation and sourcemap functions in app/controllers/api/v1_controller.rb without safe loading. Because YAML deserialization can instantiate arbitrary objects, a remote attacker can achieve code execution on the server. The flaw is rated high severity (CVSS 2.0 7.5) and a public exploit exists.
Impact
An unauthenticated remote attacker can execute arbitrary code with the privileges of the Squash web application, leading to full compromise of the host and any data it can reach.
Attack surface
Reached over the network through the Squash API endpoints that accept the namespace and sourcemap parameters; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.
Exploitation
A public exploit is available (Exploit-DB 27530) and the vendor commit is tagged Exploit and Patch, but the CVE is not in CISA KEV; EPSS is 0.46182 (98.8th percentile), indicating high predicted exploitation activity.
What to do
- Apply the vendor fix in commit 6d667c19e96e4f23dccbfbe24afeebd18e98e1c5 or upgrade to a release containing it.
- Replace unsafe YAML loading with safe_load and restrict permitted classes for the namespace and sourcemap parameters.
- If patching is not possible, block or strictly validate YAML input to the affected API endpoints at a reverse proxy or WAF.
- Restrict network access to the Squash API to trusted clients and run the service with least privilege.
Detection
- Inspect HTTP requests to the Squash API for YAML payloads in the namespace or sourcemap parameters, especially those containing object tags such as !ruby/object.
- Monitor application and web server logs for errors or stack traces from the deobfuscation and sourcemap functions.
- Alert on unexpected child processes, outbound connections, or file writes originating from the Squash web application process.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2013-5036 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2013-5036), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
