Improper Input Validation Affecting webrick Open this link in a new tab package, versions <1.4.0.beta1
Exploit Maturity
Proof of concept
Attack Complexity
Low
Confidentiality
High
Integrity
High
Availability
High
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications-
snyk-id
SNYK-RUBY-WEBRICK-1315609
-
published
1 Jul 2021
-
disclosed
1 Jul 2021
-
credit
Giovanni Pellerano (@evilaliv3), Alessandro Tanasi (@jekil), Francesco Ongaro (@ascii)
How to fix?
Upgrade webrick
to version 1.4.0.beta1 or higher.
Overview
webrick is a HTTP server toolkit that can be configured as an HTTPS server, a proxy server, and a virtual-host server.
Affected versions of this package are vulnerable to Improper Input Validation. WEBrick lets attackers to inject malicious escape sequences to its logs, making it possible for dangerous control characters to be executed on a victim's terminal emulator. This is due to data being written to a log file without sanitizing non-printable characters. Remote attackers could modify a window's title, execute arbitrary commands, or overwrite files via an HTTP request containing an escape sequence for a terminal emulator.
PoC
% xterm -e ruby -rwebrick -e 'WEBrick::HTTPServer.new(:Port=>8080).start' &
% wget http://localhost:8080/%1b%5d%32%3b%6f%77%6e%65%64%07%0a