CVE-2018-1000544
rubyzip: arbitrary file write vulnerability / arbitrary code execution using a specially crafted zip file
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , an attacker can upload a malicious file that contains symlinks or files with absolute pathnames "../" to write arbitrary files to the filesystem..
rubyzip gem rubyzip en versiones 1.2.1 y anteriores contiene una vulnerabilidad de salto de directorio en el componente Zip::File que puede resultar en la escritura de archivos arbitrarios en el sistema de archivos. Si un sitio permite la subida de archivos .zip, un atacante puede subir un archivo malicioso que contiene vínculos simbólicos o archivos con nombre de ruta absolutos "../" para escribir archivos arbitrarios en el sistema de archivos.
A directory and symbolic link traversal flaw was found in the way rubyzip gem extracts zip files. An attacker, with access to a privileged application capable of extracting zip files, could use this flaw to write new files to arbitrary paths, accessible by the aforementioned privileged application.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2018-06-15 CVE Reserved
- 2018-06-26 CVE Published
- 2023-12-27 EPSS Updated
- 2024-08-05 CVE Updated
- 2024-08-05 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-59: Improper Link Resolution Before File Access ('Link Following')
- CWE-434: Unrestricted Upload of File with Dangerous Type
CAPEC
References (6)
URL | Tag | Source |
---|---|---|
https://lists.debian.org/debian-lts-announce/2018/08/msg00013.html | Mailing List | |
https://lists.debian.org/debian-lts-announce/2020/08/msg00002.html | Mailing List |
URL | Date | SRC |
---|---|---|
https://github.com/rubyzip/rubyzip/issues/369 | 2024-08-05 |
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://access.redhat.com/errata/RHSA-2018:3466 | 2020-08-24 | |
https://access.redhat.com/security/cve/CVE-2018-1000544 | 2018-11-05 | |
https://bugzilla.redhat.com/show_bug.cgi?id=1593001 | 2018-11-05 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Rubyzip Project Search vendor "Rubyzip Project" | Rubyzip Search vendor "Rubyzip Project" for product "Rubyzip" | <= 1.2.1 Search vendor "Rubyzip Project" for product "Rubyzip" and version " <= 1.2.1" | - |
Affected
| ||||||
Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 8.0 Search vendor "Debian" for product "Debian Linux" and version "8.0" | - |
Affected
| ||||||
Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
| ||||||
Redhat Search vendor "Redhat" | Cloudforms Search vendor "Redhat" for product "Cloudforms" | 4.6 Search vendor "Redhat" for product "Cloudforms" and version "4.6" | - |
Affected
|