PT-2014-4624 · Ruby · Arabic Prawn

Larry W. Cashdollar + 1 · Published 2014-05-02 · Updated 2017-10-24 · CVE-2014-2322

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Arabic Prawn gem version 0.0.1

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the downloaded file or url variable. This is due to a problem in the lib/string utf support.rb file of the Arabic Prawn gem for Ruby.

Recommendations For Arabic Prawn gem version 0.0.1, consider disabling the use of the downloaded file and url variables until a patch is available to prevent the execution of arbitrary commands. Avoid using the downloaded file and url variables in sensitive operations to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2014-2322

GHSA-HGMW-X865-HF9X

Affected Products

Arabic Prawn

References · 7

• 🔥 http://openwall.com/lists/oss-security/2014/03/10/8 · Exploit
• 🔥 http://vapid.dhs.org/advisories/arabic-ruby-gem.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-2322 · Security Note
• https://osv.dev/vulnerability/GHSA-hgmw-x865-hf9x · Vendor Advisory
• https://github.com/ozeron/prawn-arabic · Note
• http://openwall.com/lists/oss-security/2014/03/12/6 · Note
• https://web.archive.org/web/20160306235714/http://vapid.dhs.org/advisories/arabic-ruby-gem.html · Note