CVE-2017-17405

Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a local file. If the localfile argument starts with the "|" pipe character, the command following the pipe character is executed. The default value of localfile is File.basename(remotefile), so malicious FTP servers could cause arbitrary command execution.

CVSS v3.0

8.8 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2.0

9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS

73.83% chance of exploitation in the next 30 days, 99th percentile

Published

2017-12-15

Updated

2024-08-05

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/43381

Vulhub environments (1)

• vulhub/vulhub/tree/master/ruby/CVE-2017-17405

References

• CVE Record
• NVD entry

Related

• CVE-2017-17215
• CVE-2017-17411
• CVE-2017-17130
• CVE-2017-17417
• CVE-2017-17129
• CVE-2017-17431