PT-2014-4025 · Ruby · Paratrooper-Pingdom

Larry W. Cashdollar + 1 · Published 2014-01-10 · Updated 2017-10-24 · CVE-2014-1233

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions paratrooper-pingdom gem version 1.0.0

Description The issue allows local users to obtain sensitive information, including the App-Key, username, and password values, by listing the curl process. This is possible due to the way the paratrooper-pingdom gem handles API requests. A malicious user could monitor the process tree to steal the API key, username, and password for the API login. The vulnerable code is located in the paratrooper-pingdom.rb file, where the setup and teardown methods use the curl command with the App-Key, username, and password in plain text.

Recommendations For paratrooper-pingdom gem version 1.0.0, consider disabling the setup and teardown methods in the paratrooper-pingdom.rb file until a patch is available. Restrict access to the paratrooper-pingdom gem to minimize the risk of exploitation. Avoid using the app key, username, and password variables in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2014-1233

GHSA-FQRR-RRWG-69PV

Affected Products

Paratrooper-Pingdom

References · 6

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/paratrooper-pingdom/CVE-2014-1233.yml · Exploit
• 🔥 http://vapid.dhs.org/advisories/paratrooper-api-key-pingdom.html · Exploit
• 🔥 http://openwall.com/lists/oss-security/2014/01/08/1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-1233 · Security Note
• https://osv.dev/vulnerability/GHSA-fqrr-rrwg-69pv · Vendor Advisory
• https://github.com/advisories/GHSA-fqrr-rrwg-69pv · Note