PT-2013-6041 · Ruby · Sprout

Larry W. Cashdollar + 1 · Publicado 2013-12-12 · Atualizado 2017-10-24 · CVE-2013-6421

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions sprout gem version 0.7.246

Description The issue allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename or path. This is due to a problem in the unpack zip function in archive unpacker.rb.

Recommendations For sprout gem version 0.7.246, consider disabling the unpack zip function until a patch is available to prevent the execution of arbitrary commands. Restrict the use of shell metacharacters in filenames and paths to minimize the risk of exploitation.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2013-6421

GHSA-229R-PQP6-8W6G

Produtos afetados

Sprout

Referências · 8

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sprout/CVE-2013-6421.yml · Exploit
• 🔥 http://vapid.dhs.org/advisories/sprout-0.7.246-command-inj.html · Exploit
• 🔥 http://openwall.com/lists/oss-security/2013/12/03/6 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2013/12/03/1 · Exploit
• https://github.com/lukebayes/project-sprouts · Nota
• http://archives.neohapsis.com/archives/bugtraq/2013-12/0077.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-6421 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-229r-pqp6-8w6g · Aviso do Fabricante