CVE-2009-4492 WEBrick Improper Input Validation vulnerability
Remote attackers can execute arbitrary commands or modify files via terminal escape sequences in HTTP requests to WEBrick.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2009-4492?
CVE-2009-4492 is a high-severity command injection vulnerability in n/a, published on 13 Jan 2010. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel 248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.
Which versions are affected by CVE-2009-4492?
2 open source packages ship an affected version, including webrick. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
webrick RubyGems | All versions | 1.4.0 |
webrick RubyGems | All versions | 1.4.0 |
Products include Ruby-Lang Webrick.
How do I fix CVE-2009-4492?
Upgrade webrick to 1.4.0 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2009-4492 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2009-4492 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as GHSA-6mq2-37j5-w6r6.