CVE-2017-17405
HighSummary
Ruby before 2.4.3 allows command injection in Net::FTP. Functions like get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open local files, which can lead to arbitrary command execution if the localfile argument starts with the '|' character.
Risk Assessment
Malicious FTP servers could exploit this vulnerability to execute arbitrary commands on the server, posing a serious security threat.
Recommendation
It is recommended to upgrade Ruby to version 2.4.3 or later to mitigate the risks associated with this vulnerability.
Other vulnerabilities in Ruby
See all- CVE-2014-6438High
The URI.decode_www_form_component method in Ruby before version 1.9.2-p330 allows remote attackers to cause a denial of service via a crafted string.
- CVE-2009-5147High
In Ruby versions 1.8, 1.9.0, 1.9.2, 1.9.3, 2.0.0 before patchlevel 648, and 2.1 before 2.1.8, there is a vulnerability that allows opening libraries with tainted names.
- CVE-2017-0898Critical
Ruby versions before 2.4.2, 2.3.5, and 2.2.8 are vulnerable to a malicious format string containing a precious specifier (*) with a huge negative value. This situation can lead to a buffer overrun, resulting in heap memory corruption or information disclosure from the heap.
- CVE-2017-11465Critical
The parser_yyerror function in the UTF-8 parser in Ruby 2.4.1 allows attackers to cause a denial of service (invalid write or read) or possibly have unspecified other impact via a crafted Ruby script.
- CVE-2016-2337Critical
Type confusion exists in the TclTkIp class method _cancel_eval in Ruby. An attacker passing a different type of object than String as the 'retval' argument can cause arbitrary code execution.
- CVE-2026-46727High
In Ruby 4 before 4.0.5, a use-after-free vulnerability exists in the pthread-based getaddrinfo timeout handler (rb_getaddrinfo in ext/socket/raddrinfo.c). A race condition allows a remote attacker who delays DNS responses near the user-specified timeout to crash a Ruby process calling Addrinfo.getaddrinfo(..., timeout:) or Socket.tcp(..., resolv_timeout:). Memory-corruption-based exploitation is theoretically possible.
- CVE-2025-0306High
A vulnerability in the Ruby interpreter allows a Marvin Attack, enabling an attacker to decrypt previously encrypted messages or forge signatures by exchanging a large number of messages with the vulnerable service.
Original NVD description (English source)
Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a local file. If the localfile argument starts with the "|" pipe character, the command following the pipe character is executed. The default value of localfile is File.basename(remotefile), so malicious FTP servers could cause arbitrary command execution.