brbackup Gem for Ruby dbuser Variable Shell Metacharacter Injection Remote Command Execution
Published: July 09, 2014
SECURITY IDENTIFIERS
- OSVDB: OSVDB-108900
- Vendor Advisory: https://www.openwall.com/lists/oss-security/2014/07/10/6
GEM
PATCHED VERSIONS
None available.
DESCRIPTION
brbackup Gem for Ruby contains a flaw that is triggered as input passed via the 'dbuser' variable is not properly sanitized. This may allow a remote attacker to inject shell metacharacters and execute arbitrary commands.