PT-2014-3264 · Illumina · Basespace Ruby Sdk

Larry W. Cashdollar + 1 · Published 2014-04-29 · Updated 2017-10-24 · CVE-2013-7111

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions BaseSpace Ruby SDK (aka bio-basespace-sdk) gem version 0.1.7

Description The issue concerns the put call function in the API client, specifically in the api/api client.rb file. This function uses the API KEY on the command line, allowing remote attackers to obtain sensitive information by listing the processes.

Recommendations For BaseSpace Ruby SDK (aka bio-basespace-sdk) gem version 0.1.7, consider restricting access to the api/api client.rb file or the put call function to minimize the risk of exploitation. As a temporary workaround, avoid using the API KEY on the command line until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2013-7111

GHSA-XWR3-FMGJ-MMFR

Affected Products

Basespace Ruby Sdk

References · 7

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bio-basespace-sdk/CVE-2013-7111.yml · Exploit
• 🔥 http://openwall.com/lists/oss-security/2013/12/14/2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-7111 · Security Note
• https://osv.dev/vulnerability/GHSA-xwr3-fmgj-mmfr · Vendor Advisory
• http://vapid.dhs.org/advisories/bio-basespace-sdk.html · Note
• http://openwall.com/lists/oss-security/2013/12/15/5 · Note
• https://github.com/advisories/GHSA-xwr3-fmgj-mmfr · Note