Server-side request forgery in CarrierWave

TRUNG BÌNH 4.3CVE-2021-21288 · GHSA-fwcm-636p-68r5 · Công bố 08/02/2021 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2021-21288 là lỗ hổng mức TRUNG BÌNH (CVSS 4.3) ảnh hưởng carrierwave, carrierwave (carrierwave project).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.2%, cao hơn 67.5% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2.1.1, 1.3.2 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
carrierwave RubyGems	`≥ 2.0.0, < 2.1.1< 1.3.2`	`2.1.11.3.2`
carrierwave carrierwave_project	`≥ 2.0.1, < 2.1.1< 1.3.2`	`2.1.11.3.2`

Mô tả

Impact

CarrierWave download feature has an SSRF vulnerability, allowing attacks to provide DNS entries or IP addresses that are intended for internal use and gather information about the Intranet infrastructure of the platform.

Patches

Upgrade to 2.1.1 or 1.3.2.

Workarounds

Using proper network segmentation and applying the principle of least privilege to outbound connections from application servers can reduce the severity of SSRF vulnerabilities. Ideally the vulnerable gem should run on an isolated server without access to any internal network resources or cloud metadata access.

References

Server-Side Request Forgery Prevention Cheat Sheet

For more information

If you have any questions or comments about this advisory:

Open an issue in CarrierWave repo
Email me at [email protected]

Mô tả của NVD

CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1 the download feature has an SSRF vulnerability, allowing attacks to provide DNS entries or IP addresses that are intended for internal use and gather information about the Intranet infrastructure of the platform. This is fixed in versions 1.3.2 and 2.1.1.