GHSA-fj34-jhjx-xmvv

Arbitrary file write in dragonfly

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-33473

Packages

Ecosystem	Package	Affected	Fixed in
RubyGems	dragonfly	< 1.4.0	1.4.0

Details

As written in the advisory (Markdown source, shown as plain text).

An argument injection vulnerability in Dragonfly Ruby Gem v1.3.0 allows attackers to read and write arbitrary files when the verify_url option is disabled. This vulnerability is exploited via a crafted URL.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-33473 advisory
https://github.com/markevans/dragonfly/issues/513 web
https://github.com/markevans/dragonfly/commit/25399297bb457f7fcf8e3f91e85945b255b111b5 web
https://github.com/markevans/dragonfly package
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/dragonfly/CVE-2021-33473.yml web
https://security.netapp.com/advisory/ntap-20220715-0004 web