Critical Vulnerability in Ruby Package: WEBrick Authentication Code Injection
Summary
ALPINE-CVE-2017-10784: The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute ar... Affects ruby versions < 2.4.2-r0. Fixed in 2.4.2-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ruby is a dynamic, open-source programming language with a focus on simplicity and productivity. It is widely used for web development, particularly with the Ruby on Rails framework. The WEBrick library, part of Ruby's standard library, provides HTTP server functionalities. However, it has a critical vulnerability that allows attackers to inject terminal emulator escape sequences into logs, potentially leading to arbitrary command execution.
Vulnerability Detail
The Basic authentication code in the WEBrick library in Ruby versions prior to 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 is susceptible to an injection flaw. This vulnerability allows remote attackers to craft malicious usernames that, when logged, can execute arbitrary commands on the server. The issue arises from improper handling of user input, which fails to sanitize escape sequences, leading to severe security implications.
How To Fix
Minimum fixed version
2.4.2-r0
This is the first release that contains the fix.
sudo apk add --upgrade rubyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using WEBrick for production environments until the package is updated. Consider using alternative web servers such as Puma or Unicorn that do not have this vulnerability.
Conclusion
The vulnerability in the WEBrick library of Ruby poses a significant risk due to its potential for command injection through crafted usernames. It is crucial for users to update their Ruby installations to the patched versions to mitigate this risk. Additionally, using alternative web servers can serve as a temporary measure until updates are applied.
See every vulnerability recorded for ruby →
FAQ
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Ruby versions before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 are affected by this vulnerability.
If exploited, this vulnerability could allow attackers to execute arbitrary commands on the server, leading to data breaches or server compromise.
Yes, the permanent fix is to update the Ruby package to version 2.4.2-r0 or later, which addresses the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for ruby.
