PT-2018-4164 · Ruby · Karo Gem

Larry W. Cashdollar + 1 · Publicado 2018-10-05 · Atualizado 2022-05-14 · CVE-2014-10075

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions karo gem versions 2.3.8 through 2.5.2

Description The issue allows remote command injection via the host field. A flaw in the db.rb file is triggered when handling metacharacters, which may allow a remote attacker to execute arbitrary commands. Specifically, lines 76 and 95 pass unsanitized user-supplied input to the command line. This can lead to remote command injection, particularly if the gem is used in the context of a Rails application.

Recommendations For versions 2.3.8 through 2.5.2, consider disabling the use of the host field in the db.rb file until a patch is available. Restrict access to the db.rb file to minimize the risk of exploitation. Avoid using the host field in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2014-10075

GHSA-QFWQ-CHF4-JVWG

Produtos afetados

Karo Gem

Referências · 8

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/karo/CVE-2014-10075.yml · Exploit
• 🔥 http://vapidlabs.com/advisory.php?v=63 · Exploit
• 🔥 http://vapid.dhs.org/advisories/karo-2.3.8.html · Exploit
• https://github.com/rahult/karo/blob/master/lib/karo/db.rb#L76 · Nota
• https://github.com/rahult/karo · Nota
• https://github.com/rahult/karo/blob/master/lib/karo/db.rb#L95 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-10075 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-qfwq-chf4-jvwg · Aviso do Fabricante