GSD-2021-21305
Vulnerability from gsd - Updated: 2021-02-08 00:00Details
### Impact
[CarrierWave::RMagick](https://github.com/carrierwaveuploader/carrierwave/blob/master/lib/carrierwave/processing/rmagick.rb)
has a Code Injection vulnerability. Its `#manipulate!` method inappropriately evals the content of mutation
option(`:read`/`:write`), allowing attackers to craft a string that can be executed as a Ruby code.
If an application developer supplies untrusted inputs to the option, it will lead to remote code execution(RCE).
(But supplying untrusted input to the option itself is dangerous even in absence of this vulnerability, since is prone to
DoS vulnerability - attackers can try to consume massive amounts of memory by resizing to a very large dimension)
### Proof of Concept
```ruby
class MyUploader < CarrierWave::Uploader::Base
include CarrierWave::RMagick
end
MyUploader.new.manipulate!({ read: { density: "1 }; p 'Hacked'; {" }}) # => shows "Hacked"
```
### Patches
Upgrade to [2.1.1](https://rubygems.org/gems/carrierwave/versions/2.1.1) or
[1.3.2](https://rubygems.org/gems/carrierwave/versions/1.3.2).
### Workarounds
Stop supplying untrusted input to `#manipulate!`'s mutation option.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2021-21305",
"description": "CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1, there is a code injection vulnerability. The \"#manipulate!\" method inappropriately evals the content of mutation option(:read/:write), allowing attackers to craft a string that can be executed as a Ruby code. If an application developer supplies untrusted inputs to the option, it will lead to remote code execution(RCE). This is fixed in versions 1.3.2 and 2.1.1.",
"id": "GSD-2021-21305"
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "carrierwave",
"purl": "pkg:gem/carrierwave"
}
}
],
"aliases": [
"CVE-2021-21305",
"GHSA-cf3w-g86h-35x4"
],
"details": "### Impact\n[CarrierWave::RMagick](https://github.com/carrierwaveuploader/carrierwave/blob/master/lib/carrierwave/processing/rmagick.rb)\nhas a Code Injection vulnerability. Its `#manipulate!` method inappropriately evals the content of mutation\noption(`:read`/`:write`), allowing attackers to craft a string that can be executed as a Ruby code.\nIf an application developer supplies untrusted inputs to the option, it will lead to remote code execution(RCE).\n\n(But supplying untrusted input to the option itself is dangerous even in absence of this vulnerability, since is prone to\nDoS vulnerability - attackers can try to consume massive amounts of memory by resizing to a very large dimension)\n\n### Proof of Concept\n```ruby\nclass MyUploader \u003c CarrierWave::Uploader::Base\n include CarrierWave::RMagick\nend\n\nMyUploader.new.manipulate!({ read: { density: \"1 }; p \u0027Hacked\u0027; {\" }}) # =\u003e shows \"Hacked\"\n```\n\n### Patches\nUpgrade to [2.1.1](https://rubygems.org/gems/carrierwave/versions/2.1.1) or\n[1.3.2](https://rubygems.org/gems/carrierwave/versions/1.3.2).\n\n### Workarounds\nStop supplying untrusted input to `#manipulate!`\u0027s mutation option.",
"id": "GSD-2021-21305",
"modified": "2021-02-08T00:00:00.000Z",
"published": "2021-02-08T00:00:00.000Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-cf3w-g86h-35x4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": 7.4,
"type": "CVSS_V3"
}
],
"summary": "Code Injection vulnerability in CarrierWave::RMagick"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2021-21305",
"STATE": "PUBLIC",
"TITLE": "Code Injection vulnerability in CarrierWave"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "carrierwave",
"version": {
"version_data": [
{
"version_value": "\u003c 1.3.2"
},
{
"version_value": "\u003e= 2.0.0, \u003c 2.1.1"
}
]
}
}
]
},
"vendor_name": "carrierwaveuploader"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1, there is a code injection vulnerability. The \"#manipulate!\" method inappropriately evals the content of mutation option(:read/:write), allowing attackers to craft a string that can be executed as a Ruby code. If an application developer supplies untrusted inputs to the option, it will lead to remote code execution(RCE). This is fixed in versions 1.3.2 and 2.1.1."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#132---2021-02-08",
"refsource": "MISC",
"url": "https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#132---2021-02-08"
},
{
"name": "https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#211---2021-02-08",
"refsource": "MISC",
"url": "https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#211---2021-02-08"
},
{
"name": "https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-cf3w-g86h-35x4",
"refsource": "CONFIRM",
"url": "https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-cf3w-g86h-35x4"
},
{
"name": "https://rubygems.org/gems/carrierwave",
"refsource": "MISC",
"url": "https://rubygems.org/gems/carrierwave"
},
{
"name": "https://github.com/carrierwaveuploader/carrierwave/commit/387116f5c72efa42bc3938d946b4c8d2f22181b7",
"refsource": "MISC",
"url": "https://github.com/carrierwaveuploader/carrierwave/commit/387116f5c72efa42bc3938d946b4c8d2f22181b7"
}
]
},
"source": {
"advisory": "GHSA-cf3w-g86h-35x4",
"discovery": "UNKNOWN"
}
},
"github.com/rubysec/ruby-advisory-db": {
"cve": "2021-21305",
"cvss_v3": 7.4,
"date": "2021-02-08",
"description": "### Impact\n[CarrierWave::RMagick](https://github.com/carrierwaveuploader/carrierwave/blob/master/lib/carrierwave/processing/rmagick.rb)\nhas a Code Injection vulnerability. Its `#manipulate!` method inappropriately evals the content of mutation\noption(`:read`/`:write`), allowing attackers to craft a string that can be executed as a Ruby code.\nIf an application developer supplies untrusted inputs to the option, it will lead to remote code execution(RCE).\n\n(But supplying untrusted input to the option itself is dangerous even in absence of this vulnerability, since is prone to\nDoS vulnerability - attackers can try to consume massive amounts of memory by resizing to a very large dimension)\n\n### Proof of Concept\n```ruby\nclass MyUploader \u003c CarrierWave::Uploader::Base\n include CarrierWave::RMagick\nend\n\nMyUploader.new.manipulate!({ read: { density: \"1 }; p \u0027Hacked\u0027; {\" }}) # =\u003e shows \"Hacked\"\n```\n\n### Patches\nUpgrade to [2.1.1](https://rubygems.org/gems/carrierwave/versions/2.1.1) or\n[1.3.2](https://rubygems.org/gems/carrierwave/versions/1.3.2).\n\n### Workarounds\nStop supplying untrusted input to `#manipulate!`\u0027s mutation option.",
"gem": "carrierwave",
"ghsa": "cf3w-g86h-35x4",
"patched_versions": [
"~\u003e 1.3.2",
"\u003e= 2.1.1"
],
"title": "Code Injection vulnerability in CarrierWave::RMagick",
"url": "https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-cf3w-g86h-35x4"
},
"gitlab.com": {
"advisories": [
{
"affected_range": "\u003c1.3.2||\u003e=2.0.1 \u003c2.1.1",
"affected_versions": "All versions before 1.3.2, all versions starting from 2.0.1 before 2.1.1",
"cvss_v2": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-937",
"CWE-94"
],
"date": "2022-04-26",
"description": "In CarrierWave, there is a code injection vulnerability. Attackers can craft a string that can be executed as a Ruby code.",
"fixed_versions": [
"1.3.2",
"2.1.1"
],
"identifier": "CVE-2021-21305",
"identifiers": [
"CVE-2021-21305",
"GHSA-cf3w-g86h-35x4"
],
"not_impacted": "All versions starting from 1.3.2 before 2.0.1, all versions starting from 2.1.1",
"package_slug": "gem/carrierwave",
"pubdate": "2021-02-08",
"solution": "Upgrade to versions 1.3.2, 2.1.1 or above.",
"title": "Injection Vulnerability",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2021-21305"
],
"uuid": "e38ba0ce-688e-4b1c-a939-d1081eeaaebe"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:carrierwave_project:carrierwave:*:*:*:*:*:ruby:*:*",
"cpe_name": [],
"versionEndExcluding": "1.3.2",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:carrierwave_project:carrierwave:*:*:*:*:*:ruby:*:*",
"cpe_name": [],
"versionEndExcluding": "2.1.1",
"versionStartIncluding": "2.0.1",
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2021-21305"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1, there is a code injection vulnerability. The \"#manipulate!\" method inappropriately evals the content of mutation option(:read/:write), allowing attackers to craft a string that can be executed as a Ruby code. If an application developer supplies untrusted inputs to the option, it will lead to remote code execution(RCE). This is fixed in versions 1.3.2 and 2.1.1."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-94"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#211---2021-02-08",
"refsource": "MISC",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#211---2021-02-08"
},
{
"name": "https://github.com/carrierwaveuploader/carrierwave/commit/387116f5c72efa42bc3938d946b4c8d2f22181b7",
"refsource": "MISC",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/carrierwaveuploader/carrierwave/commit/387116f5c72efa42bc3938d946b4c8d2f22181b7"
},
{
"name": "https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-cf3w-g86h-35x4",
"refsource": "CONFIRM",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-cf3w-g86h-35x4"
},
{
"name": "https://rubygems.org/gems/carrierwave",
"refsource": "MISC",
"tags": [
"Product",
"Third Party Advisory"
],
"url": "https://rubygems.org/gems/carrierwave"
},
{
"name": "https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#132---2021-02-08",
"refsource": "MISC",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#132---2021-02-08"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
},
"lastModifiedDate": "2022-04-26T15:59Z",
"publishedDate": "2021-02-08T20:15Z"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…