PT-2019-4927 · Ruby · Minimagick

Harsh Jaiswal · Published 2019-05-26 · Updated 2021-05-06 · CVE-2019-13574

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MiniMagick versions prior to 4.9.4

Description The issue exists due to insufficient input validation in MiniMagick. This allows a remote attacker to execute arbitrary code. In the lib/mini magick/image.rb file, a fetched remote image filename can cause remote command execution because Image.open input is directly passed to Kernel#open, which accepts a | character followed by a command.

Recommendations For versions prior to 4.9.4, update to version 4.9.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Image.open function with remote image filenames until a patch is applied. Avoid using the Kernel#open function with untrusted input to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

RCE

Weakness Enumeration

CWE-78

CWE-20

Related Identifiers

BDU:2020-01532

CVE-2019-13574

DLA-1948-1

DSA-4481-1

GHSA-R7J3-VVH2-XRPJ

OESA-2021-1150

Affected Products

Minimagick

References · 23

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/mini_magick/CVE-2019-13574.yml · Exploit
• 🔥 https://benjamin-bouchet.com/blog/vulnerabilite-dans-la-gem-mini_magick-version-4-9-4 · Exploit
• https://github.com/minimagick/minimagick/commit/4cd5081e58810d3394d27a67219e8e4e0445d851 · Patch
• https://github.com/minimagick/minimagick/compare/d484786...293f9bb · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-13574 · Security Note
• https://osv.dev/vulnerability/DSA-4481-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-13574 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-13574 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-13574 · Vendor Advisory
• https://debian.org/security/2019/dsa-4481 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1150 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-13574 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r7j3-vvh2-xrpj · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1948-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-13574 · Vendor Advisory