CVE-2013-1756 Dragonfly Code Injection vulnerability
Remote attackers can execute arbitrary code via crafted requests in the Dragonfly Ruby gem, requiring an upgrade to secure applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-1756?
CVE-2013-1756 is a high-severity code injection vulnerability in n/a, published on 9 Jun 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitrary code via a crafted request.
Weakness: CWE-94
Which versions are affected by CVE-2013-1756?
4 open source packages ship an affected version, including dragonfly. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
dragonfly RubyGems | From 0.7 | 0.8.6 |
dragonfly RubyGems | From 0.7 | 0.8.6 |
dragonfly RubyGems | From 0.9 | 0.9.13 |
dragonfly RubyGems | From 0.9 | 0.9.13 |
Products include Mark Evans Dragonfly Gem.
How do I fix CVE-2013-1756?
Upgrade dragonfly to a fixed version for your release line: 0.8.6 or 0.9.13.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2013-1756 being exploited?
There is no known exploitation of CVE-2013-1756 in the wild and no public exploit code.
Sources
Also known as GHSA-p463-639r-q9g9.