CVE-2017-17405 Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a local file. If the localfile argument start...
HighCVSS 8.8
EPSS 73.8%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a local file. If the localfile argument starts with the "|" pipe character, the command following the pipe character is executed. The default value of localfile is File.basename(remotefile), so malicious FTP servers could cause arbitrary command execution.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ruby-lang ruby | >= 2.2, <= 2.2.8 | No fix listed |
| ruby-lang ruby | >= 2.3, <= 2.3.5 | No fix listed |
| ruby-lang ruby | >= 2.4, <= 2.4.2 | No fix listed |
| ruby-lang ruby | = 2.5.0-preview1 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 7.4 | No fix listed |
| redhat enterprise linux server aus | = 7.6 | No fix listed |
| redhat enterprise linux server eus | = 7.4 | No fix listed |
| redhat enterprise linux server eus | = 7.5 | No fix listed |
| redhat enterprise linux server eus | = 7.6 | No fix listed |
| redhat enterprise linux server tus | = 7.4 | No fix listed |
| redhat enterprise linux server tus | = 7.6 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| alpine/ruby(Alpine:v3.10) | >= 2.2, < 2.4.3-r0 | 2.4.3-r0 |
| alpine/ruby(Alpine:v3.11) | >= 2.2, < 2.4.3-r0 | 2.4.3-r0 |
| alpine/ruby(Alpine:v3.12) | >= 2.2, < 2.4.3-r0 | 2.4.3-r0 |
| alpine/ruby(Alpine:v3.13) | >= 2.2, < 2.4.3-r0 | 2.4.3-r0 |
| alpine/ruby(Alpine:v3.14) | >= 2.2, < 2.4.3-r0 | 2.4.3-r0 |
| alpine/ruby(Alpine:v3.15) | >= 2.2, < 2.4.3-r0 | 2.4.3-r0 |
| alpine/ruby(Alpine:v3.16) | >= 2.2, < 2.4.3-r0 | 2.4.3-r0 |
| alpine/ruby(Alpine:v3.17) | >= 2.2, < 2.4.3-r0 | 2.4.3-r0 |
Show 14 more
| Product | Affected versions | Fixed in |
|---|---|---|
| alpine/ruby(Alpine:v3.18) | >= 2.2, < 2.4.3-r0 | 2.4.3-r0 |
| alpine/ruby(Alpine:v3.19) | >= 2.2, < 2.4.3-r0 | 2.4.3-r0 |
| alpine/ruby(Alpine:v3.20) | >= 2.2, < 2.4.3-r0 | 2.4.3-r0 |
| alpine/ruby(Alpine:v3.21) | >= 2.2, < 2.4.3-r0 | 2.4.3-r0 |
| alpine/ruby(Alpine:v3.22) | >= 2.2, < 2.4.3-r0 | 2.4.3-r0 |
| alpine/ruby(Alpine:v3.23) | >= 2.2, < 2.4.3-r0 | 2.4.3-r0 |
| alpine/ruby(Alpine:v3.24) | >= 2.2, < 2.4.3-r0 | 2.4.3-r0 |
| alpine/ruby(Alpine:v3.3) | >= 2.2, < 2.2.9-r0 | 2.2.9-r0 |
| alpine/ruby(Alpine:v3.4) | >= 2.2, < 2.3.6-r0 | 2.3.6-r0 |
| alpine/ruby(Alpine:v3.5) | >= 2.2, < 2.3.6-r0 | 2.3.6-r0 |
| alpine/ruby(Alpine:v3.6) | >= 2.2, < 2.4.3-r0 | 2.4.3-r0 |
| alpine/ruby(Alpine:v3.7) | >= 2.2, < 2.4.3-r0 | 2.4.3-r0 |
| alpine/ruby(Alpine:v3.8) | >= 2.2, < 2.4.3-r0 | 2.4.3-r0 |
| alpine/ruby(Alpine:v3.9) | >= 2.2, < 2.4.3-r0 | 2.4.3-r0 |
References
- 102204 third-party-advisory vdb-entry
- 1042004 third-party-advisory vdb-entry
- RHSA-2018:0378 third-party-advisory vendor-advisory
- RHSA-2018:0583 third-party-advisory vendor-advisory
- RHSA-2018:0584 third-party-advisory vendor-advisory
- RHSA-2018:0585 third-party-advisory vendor-advisory
- RHSA-2019:2806 vendor-advisory
- [debian-lts-announce] 20171225 [SECURITY] [DLA 1222-1] ruby1.8 security update mailing-list third-party-advisory
- [debian-lts-announce] 20171225 [SECURITY] [DLA 1221-1] ruby1.9.1 security update mailing-list third-party-advisory
- [debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update mailing-list third-party-advisory
- DSA-4259 third-party-advisory vendor-advisory
- 43381 exploit third-party-advisory vdb-entry
- www.ruby-lang.org vendor-advisory
- www.ruby-lang.org patch release-notes vendor-advisory
- security.alpinelinux.org vendor-advisory