Improper Input Validation Affecting webrick package, versions <1.4.0.beta1
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-WEBRICK-1315609
- published 1 Jul 2021
- disclosed 1 Jul 2021
- credit Giovanni Pellerano (@evilaliv3), Alessandro Tanasi (@jekil), Francesco Ongaro (@ascii)
How to fix?
Upgrade webrick to version 1.4.0.beta1 or higher.
Overview
webrick is a HTTP server toolkit that can be configured as an HTTPS server, a proxy server, and a virtual-host server.
Affected versions of this package are vulnerable to Improper Input Validation. WEBrick lets attackers to inject malicious escape sequences to its logs, making it possible for dangerous control characters to be executed on a victim's terminal emulator. This is due to data being written to a log file without sanitizing non-printable characters. Remote attackers could modify a window's title, execute arbitrary commands, or overwrite files via an HTTP request containing an escape sequence for a terminal emulator.
PoC
% xterm -e ruby -rwebrick -e 'WEBrick::HTTPServer.new(:Port=>8080).start' &
% wget http://localhost:8080/%1b%5d%32%3b%6f%77%6e%65%64%07%0a