PT-2021-20207 · Dragonfly · Dragonfly

Michael Tsai · Published 2021-05-27 · Updated 2021-06-10 · CVE-2021-33564

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dragonfly gem versions prior to 1.4.0

Description An argument injection issue allows remote attackers to read and write to arbitrary files via a crafted URL when the verify url option is disabled, potentially leading to code execution. This occurs because the generate and process features mishandle the use of the ImageMagick convert utility.

Recommendations For Dragonfly gem versions prior to 1.4.0, update to version 1.4.0 or later to resolve the issue. As a temporary workaround, consider enabling the verify url option to minimize the risk of exploitation. Restrict access to the generate and process features until the update is applied.

Exploit

Fix

Code Injection

Argument Injection

Weakness Enumeration

CWE-94

CWE-88

Related Identifiers

CVE-2021-33564

GHSA-J858-XP5V-F8XX

Affected Products

Dragonfly

References · 17

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/dragonfly/CVE-2021-33564.yml · Exploit
• 🔥 https://github.com/mlr0p/CVE-2021-33564 · Exploit
• 🔥 https://zxsecurity.co.nz/research/argunment-injection-ruby-dragonfly · Exploit
• 🔥 https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/master/cves/2021/CVE-2021-33564.yaml · Exploit
• https://github.com/markevans/dragonfly/commit/25399297bb457f7fcf8e3f91e85945b255b111b5 · Patch
• https://github.com/markevans/dragonfly/compare/v1.3.0...v1.4.0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-33564 · Security Note
• https://osv.dev/vulnerability/CVE-2021-33564 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j858-xp5v-f8xx · Vendor Advisory
• https://github.com/markevans/dragonfly/issues/513 · Note
• https://t.me/rnetsec/15022 · Telegram Post
• https://t.me/defcon_news/77147 · Telegram Post
• https://t.me/secharvester/11060 · Telegram Post
• https://github.com/advisories/GHSA-j858-xp5v-f8xx · Note
• https://t.me/cybersecuritytechnologies/3477 · Telegram Post