GHSA-369m-2gv6-mw28 CVE-2017-10784
WEBrick RCE Vulnerability
- Severity
- 8.8 / 10
- High · CVSS 3.0
- Exploit chance (EPSS)
- 16.41%
- Chance of exploitation in the next 30 days. Higher than 96.98% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-287 Improper Authentication
- Fix
1.4.0- Upgrade webrick to this version or later
Description
The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute arbitrary commands via a crafted user name.
Affected versions
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| webrick | < 1.4.0 |
1.4.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
webrick RubyGems → 1.4.0
- bundler
bundle update webrick # Gemfile: gem "webrick", ">= 1.4.0"
Severity breakdown
CVSS 3.0 8.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
How to prevent it
- Architecture and Design: Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
References
Advisories
Packages
Other links
- github.com/ruby/ruby/commit/6617c41292
- github.com/ruby/webrick/commit/4ac0f3843ab82d1c31e1cfc719409208adef7813
- hackerone.com/reports/223363
- ruby-lang.org/en/news/2017/09/14/webrick-basic-auth-escape-sequence-injection-cve-…
- ruby-lang.org/en/news/2017/09/14/ruby-2-3-5-released
- ruby-lang.org/en/news/2017/09/14/ruby-2-2-8-released
- debian.org/security/2017/dsa-4031
- web.archive.org/web/20211025092552/http://www.securitytracker.com/id/1039363
- web.archive.org/web/20210919031115/http://www.securitytracker.com/id/1042004
- web.archive.org/web/20210621131814/http://www.securityfocus.com/bid/100853
- usn.ubuntu.com/3685-1
- usn.ubuntu.com/3528-1
- security.gentoo.org/glsa/201710-18
- lists.debian.org/debian-lts-announce/2018/07/msg00012.html
- github.com/rubysec/ruby-advisory-db/blob/master/gems/webrick/CVE-2017-10784.yml
- access.redhat.com/errata/RHSA-2018:0585
- access.redhat.com/errata/RHSA-2018:0583
- access.redhat.com/errata/RHSA-2018:0378
- access.redhat.com/errata/RHSA-2017:3485
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-r995-q44h-hr64 Ruby WEBrick read_headers method can lead to HTTP Request/Response Smuggling | Medium | Also affects webrick |
| GHSA-6f62-3596-g6w7 HTTP Request Smuggling in ruby webrick | High | Also affects webrick |
| GHSA-gwfg-cqmg-cf8f WEBRick vulnerable to HTTP Request/Response Smuggling | High | Also affects webrick |
| GHSA-wfrc-r6c6-7j9r WEBrick Denial of Service Vulnerability | High | Also affects webrick |
| GHSA-6mq2-37j5-w6r6 WEBrick Improper Input Validation vulnerability | Medium | Also affects webrick |
| GHSA-f9x3-7vq9-cph6 Laravel TokenGuard authentication bypass through non-string API credentials | Critical | Same weakness, CWE-287 |
| GHSA-r4xp-prcw-77qf better-auth: OAuth Proxy lets an attacker sign in as another user | Critical | Same weakness, CWE-287 |
| GHSA-965c-763c-88jm better-auth: OAuth state can be used as a Magic Link to sign in as another user | Critical | Same weakness, CWE-287 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor