PT-2019-13583 · Ruby · Simple Captcha2

Published 2019-07-26 · Updated 2019-09-03 · CVE-2019-14282

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions simple captcha2 gem version 0.2.3

Description The issue concerns a code-execution backdoor that was inserted by a third party into the simple captcha2 gem for Ruby. This backdoor allows for code execution.

Recommendations For simple captcha2 gem version 0.2.3, consider removing or replacing the gem to prevent potential code execution by the backdoor. As a temporary workaround, restrict access to any applications using this gem until a secure version is available.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2019-14282

GHSA-WG6J-R28M-7293

SNYK-RUBY-SIMPLECAPTCHA2-455501

Affected Products

Simple Captcha2

References · 9

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/simple_captcha2/CVE-2019-14282.yml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-14282 · Security Note
• https://osv.dev/vulnerability/CVE-2019-14282 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wg6j-r28m-7293 · Vendor Advisory
• https://github.com/rubygems/rubygems.org/issues/2073 · Note
• https://github.com/pludoni/simple-captcha · Note
• https://snyk.io/vuln/SNYK-RUBY-SIMPLECAPTCHA2-455501 · Note
• https://rubygems.org/gems/simple_captcha2/versions · Note
• https://security.snyk.io/vuln/SNYK-RUBY-SIMPLECAPTCHA2-455501 · Note