CVE-2019-5477 Nokogiri Command Injection Vulnerability
Command injection in Nokogiri allows code execution via unsafe input to an undocumented tokenizer method, requiring specific usage patterns.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-5477?
CVE-2019-5477 is a critical command injection vulnerability in Canonical Ubuntu Linux, published on 16 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input as the filename. This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.
Weakness: CWE-78
Which versions are affected by CVE-2019-5477?
4 open source packages ship an affected version, including nokogiri and rexical. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
nokogiri RubyGems | All versions | 1.10.4 |
nokogiri RubyGems | All versions | 1.10.4 |
rexical RubyGems | All versions | 1.0.7 |
rexical RubyGems | All versions | 1.0.7 |
Products include Canonical Ubuntu Linux, Debian Debian Linux, Nokogiri Nokogiri.
How do I fix CVE-2019-5477?
Upgrade nokogiri to 1.10.4 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2019-5477 being exploited?
There is no known exploitation of CVE-2019-5477 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as DEBIAN-CVE-2019-5477, DLA-1933-1, DLA-3150-1, GHSA-cr5j-953j-xw5p, UBUNTU-CVE-2019-5477, USN-4175-1.