CVE-2017-10784 WEBrick RCE Vulnerability
Remote attackers can inject terminal escape sequences into WEBrick logs via crafted usernames, potentially executing arbitrary commands.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2017-10784?
CVE-2017-10784 is a high-severity command injection vulnerability in Ruby-Lang Ruby, published on 19 Sep 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute arbitrary commands via a crafted user name.
Weakness: CWE-287
Which versions are affected by CVE-2017-10784?
2 open source packages ship an affected version, including webrick. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
webrick RubyGems | All versions | 1.4.0 |
webrick RubyGems | All versions | 1.4.0 |
Products include Ruby-Lang Ruby.
How do I fix CVE-2017-10784?
Upgrade webrick to 1.4.0 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2017-10784 being exploited?
There is no known exploitation of CVE-2017-10784 in the wild and no public exploit code.
Other vulnerabilities in Ruby-Lang Ruby
Sources
Also known as ALPINE-CVE-2017-10784, CLEANSTART-2026-MZ31215, GHSA-369m-2gv6-mw28, UBUNTU-CVE-2017-10784.