Command Injection Vulnerability in Ruby Package: CVE-2017-17405
Summary
ALPINE-CVE-2017-17405: Ruby before 2.4.3 allows Net::FTP command injection. Affects ruby versions < 2.4.3-r0. Fixed in 2.4.3-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ruby is a dynamic, open-source programming language with a focus on simplicity and productivity. It is widely used for web development, particularly with the Ruby on Rails framework. The Ruby package in Alpine Linux provides the Ruby interpreter and standard libraries. This specific vulnerability affects the Net::FTP module, which is used for FTP operations, allowing for potential command injection through improperly handled input.
Vulnerability Detail
Ruby before version 2.4.3 is susceptible to a command injection vulnerability in the Net::FTP module. This issue arises when methods such as Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile utilize Kernel#open to open local files. If the localfile argument begins with the pipe character '|', it can lead to the execution of arbitrary commands. This vulnerability can be exploited by malicious FTP servers, resulting in severe consequences such as unauthorized command execution on the host system.
How To Fix
Minimum fixed version
2.4.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade rubyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the affected methods with untrusted input. Ensure that any localfile arguments do not start with the pipe character '|'. Additionally, consider using alternative methods for FTP operations that do not expose this vulnerability.
Conclusion
CVE-2017-17405 is a significant vulnerability in the Ruby package that can lead to command injection through the Net::FTP module. It is crucial to update to the patched version to protect your systems from potential exploitation. Regular monitoring for vulnerabilities, such as through Vulert, can help maintain the security of your applications.
See every vulnerability recorded for ruby →
FAQ
CVE-2017-17405 is a vulnerability in Ruby that allows for command injection through the Net::FTP module.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your manifest file for vulnerabilities.
Exploitation of this vulnerability can lead to arbitrary command execution on the host system, potentially compromising security.
Yes, the patch is available in Ruby version 2.4.3-r0 and later. Updating to this version will mitigate the vulnerability.
If immediate updating is not possible, ensure that you do not use the affected methods with untrusted input as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for ruby.
