Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).
CVE-2017-17405 — OS Command Injection in Ruby
Severity
8.8HIGHNVD
EPSS
88.6%
top 0.49%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
Timeline
PublishedDec 15
Latest updateMay 13
Description
Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a local file. If the localfile argument starts with the "|" pipe character, the command following the pipe character is executed. The default value of localfile is File.basename(remotefile), so malicious FTP servers could cause arbitrary command execution.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9
Affected Packages5 packages
Also affects: Debian Linux 7.0, 8.0, 9.0, Enterprise Linux 7.4, 7.6, 7.5
Patches
🔴Vulnerability Details
3💥Exploits & PoCs
1Exploit-DB
▶
📋Vendor Advisories
5Apple▶
CVE-2017-17405: macOS Mojave 10.14.1, Security Update 2018-002 High Sierra, Security Update 2018-005 Sierra↗2018-10-30
Apple▶
CVE-2017-17405: macOS High Sierra 10.13.6, Security Update 2018-004 Sierra, Security Update 2018-004 El Capitan↗2018-07-09
Red Hat▶
ruby: Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code execution↗2017-12-19