PT-2024-2479 · Ruby+7 · Rdoc+7
Oooooo_Q
·
Published
2024-03-19
·
Updated
2025-09-29
·
CVE-2024-27281
CVSS v3.1
4.5
Medium
| Vector | AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
RDoc versions 6.3.3 through 6.6.2
Description
The issue is related to the restoration of untrusted data in memory by the RDoc documentation generator for the Ruby programming language. This can be exploited to execute arbitrary code using specially crafted files with the .rdoc options extension. When parsing .rdoc options as a YAML file, object injection and resultant remote code execution are possible due to the lack of restrictions on the classes that can be restored. Additionally, when loading the documentation cache, object injection and resultant remote code execution are also possible if a crafted cache exists.
Recommendations
For Ruby 3.0 users, update to rdoc 6.3.4.1.
For Ruby 3.1 users, update to rdoc 6.4.1.1.
For Ruby 3.2 users, update to rdoc 6.5.1.1.
For other users, update the RDoc gem to version 6.6.3.1 or later.
You can use
gem update rdoc to update it. If you are using bundler, please add gem "rdoc", ">= 6.6.3.1" to your Gemfile.
As a temporary workaround, consider restricting access to the .rdoc options file to minimize the risk of exploitation.Exploit
Fix
RCE
Deserialization of Untrusted Data
Special Elements Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Almalinux
Astra Linux
Centos
Linuxmint
Rdoc
Red Hat
Rocky Linux
Ubuntu