PT-2022-10265 · Unknown · Dragonfly Ruby Gem

Mlr0Po · Published 2022-06-02 · Updated 2022-10-27 · CVE-2021-33473

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Dragonfly Ruby Gem version 1.3.0

Description An argument injection issue allows attackers to read and write arbitrary files when the verify url option is disabled. This issue is exploited via a crafted URL.

Recommendations For Dragonfly Ruby Gem version 1.3.0, consider enabling the verify url option to mitigate the risk of exploitation. As a temporary workaround, restrict access to sensitive files and directories until a patch is available.

Exploit

Fix

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2021-33473

GHSA-FJ34-JHJX-XMVV

Affected Products

Dragonfly Ruby Gem

References · 10

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/dragonfly/CVE-2021-33473.yml · Exploit
• https://github.com/markevans/dragonfly/commit/25399297bb457f7fcf8e3f91e85945b255b111b5 · Patch
• https://osv.dev/vulnerability/CVE-2021-33473 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33473 · Security Note
• https://osv.dev/vulnerability/GHSA-fj34-jhjx-xmvv · Vendor Advisory
• https://github.com/markevans/dragonfly · Note
• https://github.com/markevans/dragonfly/issues/513 · Note
• https://security.netapp.com/advisory/ntap-20220715-0004 · Note
• https://t.me/cvenotify/31064 · Telegram Post
• https://t.me/cibsecurity/43776 · Telegram Post