← Volver a CVEs
CVE-2021-33564
CRITICAL9.8
Descripcion
An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL when the verify_url option is disabled. This may lead to code execution. The problem occurs because the generate and process features mishandle use of the ImageMagick convert utility.
Detalles CVE
Puntuacion CVSS v3.19.8
SeveridadCRITICAL
Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vector de ataqueNETWORK
ComplejidadLOW
Privilegios requeridosNONE
Interaccion usuarioNONE
Publicado5/29/2021
Ultima modificacion11/21/2024
Fuentenvd
Avistamientos honeypot0
Productos afectados
dragonfly_project:dragonfly
Debilidades (CWE)
CWE-88
Referencias
https://github.com/markevans/dragonfly/commit/25399297bb457f7fcf8e3f91e85945b255b111b5(cve@mitre.org)
https://github.com/markevans/dragonfly/issues/513(cve@mitre.org)
https://github.com/mlr0p/CVE-2021-33564(cve@mitre.org)
https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/master/cves/2021/CVE-2021-33564.yaml(cve@mitre.org)
https://github.com/markevans/dragonfly/commit/25399297bb457f7fcf8e3f91e85945b255b111b5(af854a3a-2127-422b-91ae-364da2661108)
https://github.com/markevans/dragonfly/compare/v1.3.0...v1.4.0(af854a3a-2127-422b-91ae-364da2661108)
https://github.com/markevans/dragonfly/issues/513(af854a3a-2127-422b-91ae-364da2661108)
https://github.com/mlr0p/CVE-2021-33564(af854a3a-2127-422b-91ae-364da2661108)
https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/master/cves/2021/CVE-2021-33564.yaml(af854a3a-2127-422b-91ae-364da2661108)
https://zxsecurity.co.nz/research/argunment-injection-ruby-dragonfly/(af854a3a-2127-422b-91ae-364da2661108)
Correlaciones IOC
Sin correlaciones registradas
This product uses data from the NVD API but is not endorsed or certified by the NVD.