CVE-2013-2512 OS Command Injection in ftpd
Remote attackers can execute arbitrary OS commands via shell metacharacters in FTP LIST or NLST arguments in the ftpd Ruby gem.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-2512?
CVE-2013-2512 is a critical command injection vulnerability in n/a, published on 26 Jan 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The ftpd gem 0.2.1 for Ruby allows remote attackers to execute arbitrary OS commands via shell metacharacters in a LIST or NLST command argument within FTP protocol traffic.
Weakness: CWE-78
Which versions are affected by CVE-2013-2512?
2 open source packages ship an affected version, including ftpd. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ftpd RubyGems | All versions | 0.2.2 |
ftpd RubyGems | All versions | 0.2.2 |
Products include Ftpd Project Ftpd.
How do I fix CVE-2013-2512?
Upgrade ftpd to 0.2.2 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2013-2512 being exploited?
There is no known exploitation of CVE-2013-2512 in the wild and no public exploit code.
Sources
Also known as GHSA-7vxr-6cxg-j3x8.