PT-2021-20210 · Ruby-Jss+1 · Ruby-Jss+1

Actae0N · Published 2021-05-25 · Updated 2021-10-06 · CVE-2021-33575

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ruby-jss gem versions prior to 1.6.0

Description The issue allows remote attackers to execute arbitrary code due to the Plist gem's behavior of using Marshal.load during XML document processing. This behavior is documented and can be exploited for malicious purposes.

Recommendations For versions prior to 1.6.0, update to version 1.6.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Plist gem until a patch is applied.

Exploit

Fix

Related Identifiers

CVE-2021-33575

GHSA-VMFH-C547-V45H

Affected Products

Plist

Ruby-Jss

References · 9

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ruby-jss/CVE-2021-33575.yml · Exploit
• https://osv.dev/vulnerability/GHSA-vmfh-c547-v45h · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33575 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33575 · Security Note
• https://github.com/patsplat/plist/tree/ce8f9ae42a114f603ea200c955e420782bffc4ad#label-Security+considerations · Note
• https://github.com/PixarAnimationStudios/ruby-jss · Note
• https://github.com/PixarAnimationStudios/ruby-jss/blob/e6d48dd8c77f9275c76787d60d3472615fcd9b77/CHANGES.md#160---2021-05-24 · Note
• https://github.com/advisories/GHSA-vmfh-c547-v45h · Note
• https://t.me/cvenotify/15038 · Telegram Post