CVE-2017-17405
published 2017-12-15CVE-2017-17405: Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a…
PriorityP272high8.8CVSS 3.0
AVNACLPRNUIRSUCHIHAH
EXPLOIT
EPSS
73.83%
99.4th percentile
Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a local file. If the localfile argument starts with the "|" pipe character, the command following the pipe character is executed. The default value of localfile is File.basename(remotefile), so malicious FTP servers could cause arbitrary command execution.
Affected
40 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | macos_high_sierra_10.13.6_security_update_2018-004_sierra_security_update_2018-0 | — | — |
| apple | macos_mojave_10.14.1_security_update_2018-002_high_sierra_security_update_2018-0 | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_eus | — | — |
| redhat | enterprise_linux_server_eus | — | — |
| redhat | enterprise_linux_server_eus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
| redhat | enterprise_linux_workstation | — | — |
| ruby-lang | ruby | — | — |
| ruby-lang | ruby | >= 0 < 2.4.3-r0 | 2.4.3-r0 |
| ruby-lang | ruby | >= 0 < 2.4.3-r0 | 2.4.3-r0 |
| ruby-lang | ruby | >= 0 < 2.4.3-r0 | 2.4.3-r0 |
| ruby-lang | ruby | >= 0 < 2.4.3-r0 | 2.4.3-r0 |
| ruby-lang | ruby | >= 0 < 2.4.3-r0 | 2.4.3-r0 |
| ruby-lang | ruby | >= 0 < 2.4.3-r0 | 2.4.3-r0 |
| ruby-lang | ruby | >= 0 < 2.4.3-r0 | 2.4.3-r0 |
| ruby-lang | ruby | >= 0 < 2.4.3-r0 | 2.4.3-r0 |
| ruby-lang | ruby | >= 0 < 2.4.3-r0 | 2.4.3-r0 |
Detection & IOCsextracted from sources · hover to see the quote
- →The exploit triggers when a filename/localfile argument passed to Net::FTP methods (get, getbinaryfile, gettextfile, put, putbinaryfile, puttextfile) begins with the '|' pipe character, causing Kernel#open to execute the trailing string as a shell command. ↗
- →A malicious FTP server can set the remote filename to a pipe-prefixed command string; since the default localfile value is File.basename(remotefile), no explicit localfile argument is needed from the victim — monitor FTP LIST/NLST responses for filenames beginning with '|'. ↗
- →Detection opportunity: inspect FTP server responses (directory listings) for entries whose filenames start with '|'; any such filename retrieved by a Ruby Net::FTP client will be executed as a shell command. ↗
- ·The vulnerability only affects Ruby versions before 2.4.3; systems running Ruby 2.4.3 or later are not vulnerable. ↗
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
osv8.8HIGH
vendor_redhat8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Apple
CVE-2017-17405: macOS Mojave 10.14.1, Security Update 2018-002 High Sierra, Security Update 2018-005 Sierra
vendor_apple·2018-10-30·CVSS 8.8
CVE-2017-17405 [HIGH] CVE-2017-17405: macOS Mojave 10.14.1, Security Update 2018-002 High Sierra, Security Update 2018-005 Sierra
Apple Security Update: About the security content of macOS Mojave 10.14.1, Security Update 2018-002 High Sierra, Security Update 2018-005 Sierra
Product: macOS Mojave 10.14.1, Security Update 2018-002 High Sierra, Security Update 2018-005 Sierra
CVE: CVE-2017-17405
Component: CVE-2017-17405
Apple
CVE-2017-17405: macOS High Sierra 10.13.6, Security Update 2018-004 Sierra, Security Update 2018-004 El Capitan
vendor_apple·2018-07-09·CVSS 8.8
CVE-2017-17405 [HIGH] CVE-2017-17405: macOS High Sierra 10.13.6, Security Update 2018-004 Sierra, Security Update 2018-004 El Capitan
Apple Security Update: About the security content of macOS High Sierra 10.13.6, Security Update 2018-004 Sierra, Security Update 2018-004 El Capitan
Product: macOS High Sierra 10.13.6, Security Update 2018-004 Sierra, Security Update 2018-004 El Capitan
CVE: CVE-2017-17405
Component: CVE-2017-17405
Ubuntu
Ruby vulnerability
vendor_ubuntu·2018-01-04
CVE-2017-17405 Ruby vulnerability
Title: Ruby vulnerability
Summary: Ruby could be made to execute arbitrary commands if opened a specially crafted file.
It was discovered that Ruby allows FTP command injection.
An attacker could use this to cause arbitrary command execution.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
ruby: Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code execution
vendor_redhat·2017-12-19·CVSS 8.8
CVE-2017-17790 [HIGH] CWE-77 ruby: Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code execution
ruby: Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code execution
The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demonstrated by a Resolv::Hosts::new argument beginning with a '|' character, a different vulnerability than CVE-2017-17405. NOTE: situations with untrusted input may be highly unlikely.
The "lazy_initialize" function in lib/resolv.rb did not properly process certain filenames. A remote attacker could possibly exploit this flaw to inject and execute arbitrary commands.
Statement: This issue affects the versions of ruby as shipped with Red Hat Enterprise Linux 5, 6 and 7. Red Hat Product Security has rated this issue as having Low security impact. A future update may
Red Hat
ruby: Command injection vulnerability in Net::FTP
vendor_redhat·2017-12-14·CVSS 8.8
CVE-2017-17405 [HIGH] CWE-20 ruby: Command injection vulnerability in Net::FTP
ruby: Command injection vulnerability in Net::FTP
Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a local file. If the localfile argument starts with the "|" pipe character, the command following the pipe character is executed. The default value of localfile is File.basename(remotefile), so malicious FTP servers could cause arbitrary command execution.
It was discovered that the Net::FTP module did not properly process filenames in combination with certain operations. A remote attacker could exploit this flaw to execute arbitrary commands by setting up a malicious FTP server and tricking a user or Ruby application into downloading files with specially crafted names using the Net::FT
GHSA
GHSA-47cm-jxff-w8wg: The lazy_initialize function in lib/resolv
ghsa_unreviewed·2022-05-14·CVSS 8.8
CVE-2017-17790 [HIGH] CWE-74 GHSA-47cm-jxff-w8wg: The lazy_initialize function in lib/resolv
The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demonstrated by a Resolv::Hosts::new argument beginning with a '|' character, a different vulnerability than CVE-2017-17405. NOTE: situations with untrusted input may be highly unlikely.
GHSA
GHSA-q23r-c9rf-97q3: Ruby before 2
ghsa_unreviewed·2022-05-13
CVE-2017-17405 [HIGH] CWE-78 GHSA-q23r-c9rf-97q3: Ruby before 2
Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a local file. If the localfile argument starts with the "|" pipe character, the command following the pipe character is executed. The default value of localfile is File.basename(remotefile), so malicious FTP servers could cause arbitrary command execution.
OSV
CVE-2017-17790: The lazy_initialize function in lib/resolv
osv·2017-12-20·CVSS 8.8
CVE-2017-17790 [HIGH] CVE-2017-17790: The lazy_initialize function in lib/resolv
The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demonstrated by a Resolv::Hosts::new argument beginning with a '|' character, a different vulnerability than CVE-2017-17405. NOTE: situations with untrusted input may be highly unlikely.
OSV
CVE-2017-17405: Ruby before 2
osv·2017-12-15·CVSS 8.8
CVE-2017-17405 [HIGH] CVE-2017-17405: Ruby before 2
Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a local file. If the localfile argument starts with the "|" pipe character, the command following the pipe character is executed. The default value of localfile is File.basename(remotefile), so malicious FTP servers could cause arbitrary command execution.
No detection rules found.
Bugzilla
CVE-2017-17790 ruby: Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code execution
bugzilla·2017-12-21·CVSS 8.8
CVE-2017-17790 [HIGH] CVE-2017-17790 ruby: Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code execution
CVE-2017-17790 ruby: Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code execution
The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demonstrated by a Resolv::Hosts::new argument beginning with a '|' character, a different vulnerability than CVE-2017-17405. NOTE: situations with untrusted input may be highly unlikely.
Upstream bug:
https://github.com/ruby/ruby/pull/1777
Upstream patch:
https://github.com/ruby/ruby/commit/e7464561b5151501beb356fc750d5dd1a88014f7
Discussion:
Created ruby tracking bugs for this issue:
Affects: fedora-all [bug 1528226]
Created ruby193-ruby tracking bugs for this issue:
Affects: openshift-1 [bug 1528227]
---
Statement:
This issue affects the
Bugzilla
CVE-2017-17405 ruby: Command injection vulnerability in Net::FTP
bugzilla·2017-12-14·CVSS 8.8
CVE-2017-17405 [HIGH] CVE-2017-17405 ruby: Command injection vulnerability in Net::FTP
CVE-2017-17405 ruby: Command injection vulnerability in Net::FTP
There is a command injection vulnerability in Net::FTP bundled with Ruby. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a local file. If the localfile argument starts with the pipe character "|", the command following the pipe character is executed. The default value of localfile is File.basename(remotefile), so malicious FTP servers could cause arbitrary command execution.
External references:
https://www.ruby-lang.org/en/news/2017/12/14/net-ftp-command-injection-cve-2017-17405/
Discussion:
Statement:
This issue affects the versions of ruby as shipped with Red Hat Subscription Asset Manager 1 and CloudForms 5. Red Hat Product Security has rated this issue as havin
CTF
20180324-volgactf / README
ctf_writeups·2018·CVSS 8.8
[HIGH] 20180324-volgactf / README
# Volgactf CTF 2018
**It's recommended to read our responsive [web version](https://balsn.tw/ctf_writeup/20180324-volgactf/) of this writeup.**
- [Volgactf CTF 2018](#volgactf-ctf-2018)
- [Pwn](#pwn)
- [reverse](#reverse)
- [Web](#web)
- [Old Government Site (solved by sasdf, written by bookgin)](#old-government-site-solved-by-sasdf-written-by-bookgin)
- [Guess book (solved by shw15 and sasdf, written by bookgin)](#guess-book-solved-by-shw15-and-sasdf-written-by-bookgin)
- [Corp monitoring (unsolved, written by bookgin, special thanks to admin Aleksey)](#corp-monitoring-unsolved-written-by-bookgin-special-thanks-to-admin-aleksey)
- [Lazy Admin (solved by sasdf & bookgin, written by bookgin)](#lazy-admin-solved-by-sasdf--bookgin-written-by-bookgin)
- [SEO kings (solved by sasdf & bookgi
http://www.securityfocus.com/bid/102204http://www.securitytracker.com/id/1042004https://access.redhat.com/errata/RHSA-2018:0378https://access.redhat.com/errata/RHSA-2018:0583https://access.redhat.com/errata/RHSA-2018:0584https://access.redhat.com/errata/RHSA-2018:0585https://access.redhat.com/errata/RHSA-2019:2806https://lists.debian.org/debian-lts-announce/2017/12/msg00024.htmlhttps://lists.debian.org/debian-lts-announce/2017/12/msg00025.htmlhttps://lists.debian.org/debian-lts-announce/2018/07/msg00012.htmlhttps://www.debian.org/security/2018/dsa-4259https://www.exploit-db.com/exploits/43381/https://www.ruby-lang.org/en/news/2017/12/14/net-ftp-command-injection-cve-2017-17405/https://www.ruby-lang.org/en/news/2017/12/14/ruby-2-4-3-released/http://www.securityfocus.com/bid/102204http://www.securitytracker.com/id/1042004https://access.redhat.com/errata/RHSA-2018:0378https://access.redhat.com/errata/RHSA-2018:0583https://access.redhat.com/errata/RHSA-2018:0584https://access.redhat.com/errata/RHSA-2018:0585https://access.redhat.com/errata/RHSA-2019:2806https://lists.debian.org/debian-lts-announce/2017/12/msg00024.htmlhttps://lists.debian.org/debian-lts-announce/2017/12/msg00025.htmlhttps://lists.debian.org/debian-lts-announce/2018/07/msg00012.htmlhttps://www.debian.org/security/2018/dsa-4259https://www.exploit-db.com/exploits/43381/https://www.ruby-lang.org/en/news/2017/12/14/net-ftp-command-injection-cve-2017-17405/https://www.ruby-lang.org/en/news/2017/12/14/ruby-2-4-3-released/
2017-12-15
Published