Homepage About Snyk

Improper Input Validation Affecting webrick package, versions <1.4.0.beta1

0.0
critical

  • Exploit Maturity

    Proof of concept

  • Attack Complexity

    Low

  • Confidentiality

    High

  • Integrity

    High

  • Availability

    High

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

  • snyk-id

    SNYK-RUBY-WEBRICK-1315609

  • published

    1 Jul 2021

  • disclosed

    1 Jul 2021

  • credit

    Giovanni Pellerano (@evilaliv3), Alessandro Tanasi (@jekil), Francesco Ongaro (@ascii)

Report a new vulnerability Found a mistake?

Introduced: 1 Jul 2021

CVE-2009-4492 Open this link in a new tab
CWE-20 Open this link in a new tab

How to fix?

Upgrade webrick to version 1.4.0.beta1 or higher.

Overview

webrick is a HTTP server toolkit that can be configured as an HTTPS server, a proxy server, and a virtual-host server.

Affected versions of this package are vulnerable to Improper Input Validation. WEBrick lets attackers to inject malicious escape sequences to its logs, making it possible for dangerous control characters to be executed on a victim's terminal emulator. This is due to data being written to a log file without sanitizing non-printable characters. Remote attackers could modify a window's title, execute arbitrary commands, or overwrite files via an HTTP request containing an escape sequence for a terminal emulator.

PoC

% xterm -e ruby -rwebrick -e 'WEBrick::HTTPServer.new(:Port=>8080).start' &
% wget http://localhost:8080/%1b%5d%32%3b%6f%77%6e%65%64%07%0a