CVE-2014-1835 Echor Ruby Gem credentials can be stolen via process table monitoring
HighCVSS 7.8
EPSS 0.34%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
The perform_request function in /lib/echor/backplane.rb in echor 0.1.6 Ruby Gem allows local users to steal the login credentials by watching the process table.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems echor(RubyGems) | <= 0.1.6 | No fix listed |
| rubygems echor(RubyGems) | = 0.1.4 | No fix listed |
| rubygems echor(RubyGems) | = 0.1.5 | No fix listed |
| rubygems echor(RubyGems) | = 0.1.6 | No fix listed |
| echor project echor | = 0.1.6 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- [oss-security] 20140131 Re: echor 0.1.6 Ruby Gem exposes login credentials mailing-list third-party-advisory
- github.com exploit
- github.com
- echor-ruby-system-process-info-disc(90858) broken-link vdb-entry