CVE-2021-21288 Server-side request forgery in CarrierWave

What is CVE-2021-21288?

CVE-2021-21288 is a medium-severity server-side request forgery vulnerability in carrierwaveuploader carrierwave, published on 8 Feb 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1 the download feature has an SSRF vulnerability, allowing attacks to provide DNS entries or IP addresses that are intended for internal use and gather information about the Intranet infrastructure of the platform. This is fixed in versions 1.3.2 and 2.1.1.

Weakness: CWE-918

Which versions are affected by CVE-2021-21288?

4 open source packages ship an affected version, including carrierwave. It affects 1 product.

Products include Carrierwave Project Carrierwave.

How do I fix CVE-2021-21288?

Upgrade carrierwave to a fixed version for your release line: 1.3.2 or 2.1.1.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2021-21288 being exploited?

There is no known exploitation of CVE-2021-21288 in the wild and no public exploit code.

Other vulnerabilities in carrierwaveuploader carrierwave

• CVE-2021-21305 Code Injection vulnerability in CarrierWave High 7.4
• CVE-2024-29034 CarrierWave's Content-Type allowlist bypass vulnerability which possibly leads to XSS remained Medium 6.8
• CVE-2023-49090 CarrierWave has a content-type allowlist bypass vulnerability, possibly leading to XSS Medium 6.8
• CVE-2026-44587 CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters Medium 4.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2021-21288, GHSA-fwcm-636p-68r5.