PT-2017-10747 · Ruby · Rvm

Publicado 2017-07-13 · Atualizado 2019-10-03 · CVE-2017-1000037

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RVM (affected versions not specified)

Description The issue concerns command and code execution due to RVM's automatic loading of environment variables and execution of hooks from files in the current working directory ($PWD). This allows for command injection when RVM loads environment variables from files in $PWD. Additionally, RVM automatically installs gems and performs "bundle install" on a Gemfile as specified by .versions.conf in $PWD, resulting in code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2017-1000037

Produtos afetados

Rvm

Referências · 3

• 🔥 https://github.com/justinsteven/advisories/blob/master/2017_rvm_cd_command_execution.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000037 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-1000037 · Aviso do Fabricante