CVE-2014-1834 Echor contains Command Injection
HighCVSS 7.8
EPSS 0.41%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
The perform_request function in /lib/echor/backplane.rb in echor 0.1.6 Ruby Gem allows local users to inject arbitrary code by adding a semi-colon in their username or password.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems echor(RubyGems) | <= 0.1.6 | No fix listed |
| rubygems echor(RubyGems) | = 0.1.4 | No fix listed |
| rubygems echor(RubyGems) | = 0.1.5 | No fix listed |
| rubygems echor(RubyGems) | = 0.1.6 | No fix listed |
| echor project echor | = 0.1.6 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- [oss-security] 20140131 Re: echor 0.1.6 Ruby Gem exposes login credentials mailing-list third-party-advisory
- github.com exploit
- github.com