CVE-2021-31810 Server-side request forgery in n/a
A malicious FTP server can trick Ruby's Net::FTP into connecting to arbitrary internal addresses, enabling port scans and service banner extraction.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-31810?
CVE-2021-31810 is a medium-severity server-side request forgery vulnerability in Debian Debian Linux, published on 13 Jul 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions).
Which versions are affected by CVE-2021-31810?
2 open source packages ship an affected version, including ruby and ruby-min. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
ruby Bitnami | All versions | 2.6.8, 2.7.4, 3.0.2 |
ruby-min Bitnami | All versions | 2.6.8, 2.7.4, 3.0.2 |
Products include Debian Debian Linux, Oracle Jd Edwards Enterpriseone Tools, Ruby-Lang Ruby.
How do I fix CVE-2021-31810?
Upgrade ruby to a fixed version for your release line: 2.6.8, 2.7.4 or 3.0.2.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2021-31810 being exploited?
There is no known exploitation of CVE-2021-31810 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2021-31810, BIT-ruby-2021-31810, BIT-ruby-min-2021-31810, CLEANSTART-2026-GT10640, DEBIAN-CVE-2021-31810, GHSA-wr95-679j-87v9 and 2 more.