PT-2018-4242 · Ruby · Lawn-Login Gem

Larry W. Cashdollar + 1 · Published 2018-01-10 · Updated 2018-01-30 · CVE-2014-5000

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions lawn-login gem version 0.0.7

Description The issue concerns the login function in the lawn-login gem for Ruby, which places credentials on the curl command line. This allows local users to obtain sensitive information by listing the process. The lib/lawn.rb file is specifically affected.

Recommendations For version 0.0.7, consider modifying the login function to avoid placing credentials on the command line, or restrict access to process listings to minimize the risk of exploitation. As a temporary workaround, consider disabling the login function until a patch is available.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2014-5000

GHSA-RHGQ-VV9X-J4P5

Affected Products

Lawn-Login Gem

References · 8

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lawn-login/CVE-2014-5000.yml · Exploit
• 🔥 http://vapid.dhs.org/advisories/lawn-login-0.0.7.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-5000 · Security Note
• https://osv.dev/vulnerability/GHSA-rhgq-vv9x-j4p5 · Vendor Advisory
• https://github.com/skalnik/lawn-login · Note
• https://web.archive.org/web/20200229060607/http://vapid.dhs.org/advisories/lawn-login-0.0.7.html · Note
• http://openwall.com/lists/oss-security/2014/07/17/5 · Note
• http://openwall.com/lists/oss-security/2014/07/07/20 · Note