PT-2017-10747 · Ruby · Rvm

Published 2017-07-13 · Updated 2019-10-03 · CVE-2017-1000037

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RVM (affected versions not specified)

Description The issue concerns command and code execution due to RVM's automatic loading of environment variables and execution of hooks from files in the current working directory ($PWD). This allows for command injection when RVM loads environment variables from files in $PWD. Additionally, RVM automatically installs gems and performs "bundle install" on a Gemfile as specified by .versions.conf in $PWD, resulting in code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2017-1000037

Affected Products

Rvm

References · 3

• 🔥 https://github.com/justinsteven/advisories/blob/master/2017_rvm_cd_command_execution.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000037 · Security Note
• https://osv.dev/vulnerability/CVE-2017-1000037 · Vendor Advisory