CVE-2021-21305 Code Injection vulnerability in CarrierWave
Attackers can execute arbitrary Ruby code via crafted mutation options in CarrierWave if developers supply untrusted inputs to these options.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-21305?
CVE-2021-21305 is a high-severity code injection vulnerability in carrierwaveuploader carrierwave, published on 8 Feb 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1, there is a code injection vulnerability. The "#manipulate!" method inappropriately evals the content of mutation option(:read/:write), allowing attackers to craft a string that can be executed as a Ruby code. If an application developer supplies untrusted inputs to the option, it will lead to remote code execution(RCE). This is fixed in versions 1.3.2 and 2.1.1.
Which versions are affected by CVE-2021-21305?
4 open source packages ship an affected version, including carrierwave. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
carrierwave RubyGems | All versions | 1.3.2 |
carrierwave RubyGems | All versions | 1.3.2 |
carrierwave RubyGems | From 2.0.0 | 2.1.1 |
carrierwave RubyGems | From 2.0.0 | 2.1.1 |
Products include Carrierwave Project Carrierwave.
How do I fix CVE-2021-21305?
Upgrade carrierwave to a fixed version for your release line: 1.3.2 or 2.1.1.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2021-21305 being exploited?
There is no known exploitation of CVE-2021-21305 in the wild and no public exploit code.
Other vulnerabilities in carrierwaveuploader carrierwave
- CVE-2024-29034 CarrierWave's Content-Type allowlist bypass vulnerability which possibly leads to XSS remained
- CVE-2023-49090 CarrierWave has a content-type allowlist bypass vulnerability, possibly leading to XSS
- CVE-2026-44587 CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters
- CVE-2021-21288 Server-side request forgery in CarrierWave
Sources
Also known as DEBIAN-CVE-2021-21305, GHSA-cf3w-g86h-35x4, UBUNTU-CVE-2021-21305.