CVE-2017-17405 Command injection in n/a

High 8.8 Published 15 Dec 2017 Updated 5 Aug 2024

A malicious FTP server can trigger arbitrary command execution in Ruby applications using Net::FTP due to unsafe file handling in Kernel#open.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2017-17405?

CVE-2017-17405 is a high-severity command injection vulnerability in Debian Debian Linux, published on 15 Dec 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a local file. If the localfile argument starts with the "|" pipe character, the command following the pipe character is executed. The default value of localfile is File.basename(remotefile), so malicious FTP servers could cause arbitrary command execution.

Weakness: CWE-78

Which versions are affected by CVE-2017-17405?

It affects 8 products.

Linux distribution packages (40)

`ruby` Red Hat:rhel_aus:7.3::server	All versions	`0:2.0.0.648-30.el7_3`
`ruby-debuginfo` Red Hat:rhel_aus:7.3::server	All versions	`0:2.0.0.648-30.el7_3`
`ruby-devel` Red Hat:rhel_aus:7.3::server	All versions	`0:2.0.0.648-30.el7_3`
`ruby-doc` Red Hat:rhel_aus:7.3::server	All versions	`0:2.0.0.648-30.el7_3`
`ruby-irb` Red Hat:rhel_aus:7.3::server	All versions	`0:2.0.0.648-30.el7_3`
`ruby-libs` Red Hat:rhel_aus:7.3::server	All versions	`0:2.0.0.648-30.el7_3`
`ruby-tcltk` Red Hat:rhel_aus:7.3::server	All versions	`0:2.0.0.648-30.el7_3`
`rubygem-bigdecimal` Red Hat:rhel_aus:7.3::server	All versions	`0:1.2.0-30.el7_3`
`rubygem-io-console` Red Hat:rhel_aus:7.3::server	All versions	`0:0.4.2-30.el7_3`
`rubygem-json` Red Hat:rhel_aus:7.3::server	All versions	`0:1.7.7-30.el7_3`
`rubygem-minitest` Red Hat:rhel_aus:7.3::server	All versions	`0:4.3.2-30.el7_3`
`rubygem-psych` Red Hat:rhel_aus:7.3::server	All versions	`0:2.0.0-30.el7_3`
`rubygem-rake` Red Hat:rhel_aus:7.3::server	All versions	`0:0.9.6-30.el7_3`
`rubygem-rdoc` Red Hat:rhel_aus:7.3::server	All versions	`0:4.0.0-30.el7_3`
`rubygems` Red Hat:rhel_aus:7.3::server	All versions	`0:2.0.14.1-30.el7_3`
`rubygems-devel` Red Hat:rhel_aus:7.3::server	All versions	`0:2.0.14.1-30.el7_3`
`ruby` Red Hat:rhel_e4s:7.3::server	All versions	`0:2.0.0.648-30.el7_3`
`ruby-debuginfo` Red Hat:rhel_e4s:7.3::server	All versions	`0:2.0.0.648-30.el7_3`
`ruby-devel` Red Hat:rhel_e4s:7.3::server	All versions	`0:2.0.0.648-30.el7_3`
`ruby-doc` Red Hat:rhel_e4s:7.3::server	All versions	`0:2.0.0.648-30.el7_3`
`ruby-irb` Red Hat:rhel_e4s:7.3::server	All versions	`0:2.0.0.648-30.el7_3`
`ruby-libs` Red Hat:rhel_e4s:7.3::server	All versions	`0:2.0.0.648-30.el7_3`
`ruby-tcltk` Red Hat:rhel_e4s:7.3::server	All versions	`0:2.0.0.648-30.el7_3`
`rubygem-bigdecimal` Red Hat:rhel_e4s:7.3::server	All versions	`0:1.2.0-30.el7_3`
`rubygem-io-console` Red Hat:rhel_e4s:7.3::server	All versions	`0:0.4.2-30.el7_3`
`rubygem-json` Red Hat:rhel_e4s:7.3::server	All versions	`0:1.7.7-30.el7_3`
`rubygem-minitest` Red Hat:rhel_e4s:7.3::server	All versions	`0:4.3.2-30.el7_3`
`rubygem-psych` Red Hat:rhel_e4s:7.3::server	All versions	`0:2.0.0-30.el7_3`
`rubygem-rake` Red Hat:rhel_e4s:7.3::server	All versions	`0:0.9.6-30.el7_3`
`rubygem-rdoc` Red Hat:rhel_e4s:7.3::server	All versions	`0:4.0.0-30.el7_3`
`rubygems` Red Hat:rhel_e4s:7.3::server	All versions	`0:2.0.14.1-30.el7_3`
`rubygems-devel` Red Hat:rhel_e4s:7.3::server	All versions	`0:2.0.14.1-30.el7_3`
`ruby` Red Hat:rhel_tus:7.3::server	All versions	`0:2.0.0.648-30.el7_3`
`ruby-debuginfo` Red Hat:rhel_tus:7.3::server	All versions	`0:2.0.0.648-30.el7_3`
`ruby-devel` Red Hat:rhel_tus:7.3::server	All versions	`0:2.0.0.648-30.el7_3`
`ruby-doc` Red Hat:rhel_tus:7.3::server	All versions	`0:2.0.0.648-30.el7_3`
`ruby-irb` Red Hat:rhel_tus:7.3::server	All versions	`0:2.0.0.648-30.el7_3`
`ruby-libs` Red Hat:rhel_tus:7.3::server	All versions	`0:2.0.0.648-30.el7_3`
`ruby-tcltk` Red Hat:rhel_tus:7.3::server	All versions	`0:2.0.0.648-30.el7_3`
`rubygem-bigdecimal` Red Hat:rhel_tus:7.3::server	All versions	`0:1.2.0-30.el7_3`

Products include Debian Debian Linux, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Server Aus, Redhat Enterprise Linux Server Eus, Redhat Enterprise Linux Server Tus and 2 more.

How do I fix CVE-2017-17405?

Upgrade to a fixed version.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2017-17405 being exploited?

There is no known exploitation of CVE-2017-17405 in the wild and no public exploit code.

Public exploit code: 1 Exploit-DB entry.

All Debian Debian Linux vulnerabilities

Sources

Also known as ALPINE-CVE-2017-17405, CLEANSTART-2026-YL35253, GHSA-q23r-c9rf-97q3, RHSA-2019:2806, UBUNTU-CVE-2017-17405, USN-3515-1.