PT-2021-14391 · Unknown · Carrierwave

Mshibuya · Published 2021-02-08 · Updated 2021-02-12 · CVE-2021-21288

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: CarrierWave versions prior to 1.3.2 CarrierWave versions prior to 2.1.1

Description: The download feature in CarrierWave has a Server-Side Request Forgery (SSRF) vulnerability, allowing attacks to provide DNS entries or IP addresses intended for internal use and gather information about the Intranet infrastructure of the platform.

Recommendations: For versions prior to 1.3.2, upgrade to version 1.3.2. For versions prior to 2.1.1, upgrade to version 2.1.1. As a temporary workaround, consider using proper network segmentation and applying the principle of least privilege to outbound connections from application servers to reduce the severity of SSRF vulnerabilities. Ideally, the vulnerable gem should run on an isolated server without access to any internal network resources or cloud metadata access.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2021-21288

GHSA-FWCM-636P-68R5

Affected Products

Carrierwave

References · 16

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/carrierwave/CVE-2021-21288.yml · Exploit
• https://github.com/carrierwaveuploader/carrierwave/commit/012702eb3ba1663452aa025831caa304d1a665c0 · Patch
• https://cve.org/CVERecord?id=CVE-2021-21288 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-21288 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-21288 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fwcm-636p-68r5 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-21288 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21288 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-21288 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-21288 · Vendor Advisory
• https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-fwcm-636p-68r5 · Note
• https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#132---2021-02-08 · Note
• https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#211---2021-02-08 · Note
• https://github.com/carrierwaveuploader/carrierwave · Note
• https://rubygems.org/gems/carrierwave · Note