Command Injection Vulnerability in Ruby's Net::FTP Module
CVE-2017-17405
8.8HIGH
What is CVE-2017-17405?
A command injection vulnerability exists in the Net::FTP library of Ruby versions prior to 2.4.3. This flaw arises when commands are executed from user-controlled input in FTP operations, allowing attackers to manipulate the 'localfile' argument. If this argument begins with a pipe character ('|'), any command following it will be executed, potentially leading to unauthorized access and execution of arbitrary commands. Malicious FTP servers can exploit this behavior, further compromising the security of the affected systems.
References
EPSS Score
88% chance of being exploited in the next 30 days.
CVSS V3.1
Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved