PT-2018-4164 · Ruby · Karo Gem

Larry W. Cashdollar + 1 · Published 2018-10-05 · Updated 2022-05-14 · CVE-2014-10075

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions karo gem versions 2.3.8 through 2.5.2

Description The issue allows remote command injection via the host field. A flaw in the db.rb file is triggered when handling metacharacters, which may allow a remote attacker to execute arbitrary commands. Specifically, lines 76 and 95 pass unsanitized user-supplied input to the command line. This can lead to remote command injection, particularly if the gem is used in the context of a Rails application.

Recommendations For versions 2.3.8 through 2.5.2, consider disabling the use of the host field in the db.rb file until a patch is available. Restrict access to the db.rb file to minimize the risk of exploitation. Avoid using the host field in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2014-10075

GHSA-QFWQ-CHF4-JVWG

Affected Products

Karo Gem

References · 8

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/karo/CVE-2014-10075.yml · Exploit
• 🔥 http://vapidlabs.com/advisory.php?v=63 · Exploit
• 🔥 http://vapid.dhs.org/advisories/karo-2.3.8.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-10075 · Security Note
• https://osv.dev/vulnerability/GHSA-qfwq-chf4-jvwg · Vendor Advisory
• https://github.com/rahult/karo/blob/master/lib/karo/db.rb#L76 · Note
• https://github.com/rahult/karo · Note
• https://github.com/rahult/karo/blob/master/lib/karo/db.rb#L95 · Note