GHSA-j858-xp5v-f8xx

Dragonfly contains remote code execution vulnerability

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-33564

Packages

Ecosystem	Package	Affected	Fixed in
RubyGems	dragonfly	< 1.4.0	1.4.0

Details

As written in the advisory (Markdown source, shown as plain text).

An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL when the `verify_url` option is disabled. This may lead to code execution. The problem occurs because the generate and process features mishandle use of the ImageMagick convert utility.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-33564 advisory
https://github.com/markevans/dragonfly/issues/513 web
https://github.com/markevans/dragonfly/commit/25399297bb457f7fcf8e3f91e85945b255b111b5 web
https://github.com/advisories/GHSA-j858-xp5v-f8xx advisory
https://github.com/markevans/dragonfly/compare/v1.3.0...v1.4.0 web
https://github.com/mlr0p/CVE-2021-33564 web
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/dragonfly/CVE-2021-33564.yml web
https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/master/cves/2021/CVE-2021-33564.yaml web
https://zxsecurity.co.nz/research/argunment-injection-ruby-dragonfly web