CVE-2013-4457 Cocaine Gem OS Command Injection vulnerability
Attackers can execute arbitrary commands via crafted hash objects in the Cocaine Ruby gem due to recursive variable interpolation flaws.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-4457?
CVE-2013-4457 is a medium-severity command injection vulnerability in n/a, published on 2 Nov 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Cocaine gem 0.4.0 through 0.5.2 for Ruby allows context-dependent attackers to execute arbitrary commands via a crafted has object, related to recursive variable interpolation.
Weakness: CWE-78
Which versions are affected by CVE-2013-4457?
2 open source packages ship an affected version, including cocaine. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
cocaine RubyGems | From 0.4.0 | 0.5.3 |
cocaine RubyGems | From 0.4.0 | 0.5.3 |
Products include Thoughtbot Cocaine.
How do I fix CVE-2013-4457?
Upgrade cocaine to 0.5.3 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2013-4457 being exploited?
There is no known exploitation of CVE-2013-4457 in the wild and no public exploit code.
Sources
Also known as GHSA-c43v-hrmg-56r4.