gnms Gem for Ruby /lib/cmd_parse.rb ip Variable Shell Metacharacter Handling Remote Command Injection
Published: June 30, 2014
SECURITY IDENTIFIERS
- OSVDB: OSVDB-108594
- Vendor Advisory: http://www.vapidlabs.com/advisories/gnms-2.1.1.html
GEM
PATCHED VERSIONS
None available.
DESCRIPTION
gnms Gem for Ruby contains a flaw in /lib/cmd_parse.rb that is triggered when handling shell metacharacters passed via the 'ip' variable. This may allow a remote attacker to inject arbitrary commands.