PT-2017-6689 · Ruby · Open-Uri-Cached

Published 2017-08-18 · Updated 2022-05-13 · CVE-2015-3649

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions open-uri-cached rubygem (affected versions not specified)

Description The issue allows local users to execute arbitrary Ruby code. This is achieved by creating a directory under /tmp with a specific name, including "openuri-" followed by a crafted UID. Once a meta file is created in this directory, an attacker can place Ruby code there, which will then be executed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2015-3649

GHSA-7M2W-9GW7-C3XP

Affected Products

Open-Uri-Cached

References · 14

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/open-uri-cached/CVE-2015-3649.yml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-3649 · Security Note
• https://osv.dev/vulnerability/GHSA-7m2w-9gw7-c3xp · Vendor Advisory
• https://github.com/tigris/open-uri-cached · Note
• https://github.com/tigris/open-uri-cached/issues/8 · Note
• https://github.com/tigris/open-uri-cached/blob/master/lib/open-uri/cached.rb#L25 · Note
• https://github.com/tigris/open-uri-cached/blob/master/lib/open-uri/cached.rb#L115 · Note
• https://github.com/tigris/open-uri-cached/blob/master/lib/open-uri/cached.rb#L39 · Note
• https://github.com/tigris/open-uri-cached/blob/master/lib/open-uri/cached.rb · Note
• http://openwall.com/lists/oss-security/2015/05/06/2 · Note
• https://web.archive.org/web/20210119122105/http://securityfocus.com/bid/74469 · Note
• http://benjaminfleischer.com/2013/03/20/yaml-and-security-in-ruby · Note
• http://seclists.org/oss-sec/2015/q2/373 · Note
• http://securityfocus.com/bid/74469 · Note