GHSA-fwcm-636p-68r5 CVE-2021-21288
Server-side request forgery in CarrierWave
- Severity
- 4.3 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 1.17%
- Chance of exploitation in the next 30 days. Higher than 67.47% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-918 Server-Side Request Forgery (SSRF)
- Fix
1.3.2- Upgrade carrierwave to this version or later
Description
Impact
CarrierWave download feature has an SSRF vulnerability, allowing attacks to provide DNS entries or IP addresses that are intended for internal use and gather information about the Intranet infrastructure of the platform.
Patches
Workarounds
Using proper network segmentation and applying the principle of least privilege to outbound connections from application servers can reduce the severity of SSRF vulnerabilities. Ideally the vulnerable gem should run on an isolated server without access to any internal network resources or cloud metadata access.
References
Server-Side Request Forgery Prevention Cheat Sheet
For more information
If you have any questions or comments about this advisory:
- Open an issue in CarrierWave repo
- Email me at mit.shibuya@gmail.com
Affected versions
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| carrierwave | < 1.3.2 |
1.3.2 |
| carrierwave | >= 2.0.0, < 2.1.1 |
2.1.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
carrierwave RubyGems → 1.3.2
- bundler
bundle update carrierwave # Gemfile: gem "carrierwave", ">= 1.3.2"
Severity breakdown
CVSS 3.1 4.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Weakness
CWE-918: Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
References
Advisories
Packages
Other links
- github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-fwcm-636p-68r5
- github.com/carrierwaveuploader/carrierwave/commit/012702eb3ba1663452aa025831caa…
- github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md
- github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md
- github.com/rubysec/ruby-advisory-db/blob/master/gems/carrierwave/CVE-2021-21288…
- rubygems.org/gems/carrierwave
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-7g26-2qgj-chfg CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters | Medium | Also affects carrierwave |
| GHSA-vfmv-jfc5-pjjw CarrierWave content-Type allowlist bypass vulnerability which possibly leads to XSS remained | Medium | Also affects carrierwave |
| GHSA-gxhx-g4fq-49hj CarrierWave Content-Type allowlist bypass vulnerability, possibly leading to XSS | Medium | Also affects carrierwave |
| GHSA-cf3w-g86h-35x4 Code Injection vulnerability in CarrierWave::RMagick | High | Also affects carrierwave |
| EEF-CVE-2026-115700 SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney | Not rated yet | Same weakness, CWE-918 |
| GHSA-2wqp-q3c6-ccj5 MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints | Medium | Same weakness, CWE-918 |
| GHSA-2phh-27fw-q4gc PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading | Medium | Same weakness, CWE-918 |
| GHSA-p3pr-8f3m-4qp8 pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host | Medium | Same weakness, CWE-918 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor