CVE-2021-33564
CRITICAL 9.8EPSS 72.1%
An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL when the verify_url option is disabled. This may lead to code execution. The problem occurs because the generate and process features mishandle use of the ImageMagick convert utility.
- CVSS v3.1 NVD
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v2.0 NVD
- 6.8 MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P - EPSS
- 72.14% chance of exploitation in the next 30 days, 99th percentile
- Nuclei
- critical · CWE-88
- Published
- 2021-05-29
- Updated
- 2024-08-03
Proof-of-concept exploits (3)
- mlr0p/CVE-2021-3356416★ · 2021-05-26
- https://zxsecurity.co.nz/research/argunment-injection-ruby-dragonfly/
- dorkerdevil/CVE-2021-335640★ · 2021-05-27
Nuclei templates (1)
Security advisories
- markevans/dragonfly/issues/513
- https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/master/cves/2021/CVE-…
- https://zxsecurity.co.nz/research/argunment-injection-ruby-dragonfly
- advisories/GHSA-j858-xp5v-f8xx