PT-2021-18004 · Ruby · Ruby

Bugdiscloseguys + 1 · Published 2021-04-05 · Updated 2025-01-27 · CVE-2021-28966

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Ruby versions prior to 3.0 on Windows

Description: A remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir, potentially allowing them to exit the directory and impact the system. There is an unintentional directory creation vulnerability in the tmpdir library bundled with Ruby on Windows, and an unintentional file creation vulnerability in the tempfile library, as it uses tmpdir internally.

Recommendations: For Ruby versions prior to 3.0 on Windows, consider restricting access to the tmpdir library and tempfile library until a patch is available. As a temporary workaround, avoid using the tmpdir library and tempfile library in Web applications that handle parameters with TmpDir.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BIT-RUBY-2021-28966

BIT-RUBY-MIN-2021-28966

CVE-2021-28966

GHSA-46F2-3V63-3XRP

Affected Products

Ruby

References · 17

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/tmpdir/CVE-2021-28966.yml · Exploit
• 🔥 https://hackerone.com/reports/1131465 · Exploit
• https://osv.dev/vulnerability/GHSA-46f2-3v63-3xrp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28966 · Security Note
• https://osv.dev/vulnerability/CVE-2021-28966 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-ruby-min-2021-28966 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-ruby-2021-28966 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2021-28966 · Vendor Advisory
• https://github.com/ruby/tmpdir/commit/93798c01cb7c10476e50a4d80130a329ba47f348 · Note
• https://github.com/ruby/tmpdir · Note
• https://github.com/ruby/tmpdir/pull/8 · Note
• https://security.netapp.com/advisory/ntap-20210902-0004 · Note
• https://security.alpinelinux.org/vuln/CVE-2021-28966 · Note
• https://ruby-lang.org/en/news/2021/04/05/tempfile-path-traversal-on-windows-cve-2021-28966 · Note
• https://t.me/cibsecurity/26595 · Telegram Post