Dragonfly Gem for Ruby Image Uploading & Processing Remote Command Execution
Published: August 25, 2014
SECURITY IDENTIFIERS
- OSVDB: OSVDB-110439
- Vendor Advisory: https://security.snyk.io/vuln/SNYK-RUBY-DRAGONFLY-20193
GEM
PATCHED VERSIONS
>= 1.0.7
DESCRIPTION
Dragonfly Gem for Ruby contains a flaw in Uploading & Processing that is due to the gem failing to restrict arbitrary commands to imagemagicks convert. This may allow a remote attacker to gain read/write access to the filesystem and execute arbitrary commands.