Tóm tắt nhanh
- CVE-2023-28102 là lỗ hổng mức NGHIÊM TRỌNG (CVSS 9.6) ảnh hưởng discordrb, discordrb (discordrb project).
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 2.6%, cao hơn 85.2% các lỗ hổng khác.
- Cách xử lý: cập nhật lên 3.4.3, 2023-03-08 hoặc mới hơn.
| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|
| discordrb RubyGems | < 3.4.3
| 3.4.3
|
| discordrb | < 2023-03-08
| 2023-03-08
|
Mô tả
discordrb is an implementation of the Discord API using Ruby. In discordrb before commit 91e13043ffa the encoder.rb file unsafely constructs a shell string using the file parameter, which can potentially leave clients of discordrb vulnerable to command injection. The library is not directly exploitable: the exploit requires that some client of the library calls the vulnerable method with user input. However, if unsafe input reaches the library method, then an attacker can execute arbitrary shell commands on the host machine. Full impact will depend on the permissions of the process running the discordrb library and will likely not be total system access. This issue has been addressed in code, but a new release of the discordrb gem has not been uploaded to rubygems. This issue is also tracked as GHSL-2022-094.
Mô tả của NVD
discordrb is an implementation of the Discord API using Ruby. In discordrb before commit `91e13043ffa` the `encoder.rb` file unsafely constructs a shell string using the file parameter, which can potentially leave clients of discordrb vulnerable to command injection. The library is not directly exploitable: the exploit requires that some client of the library calls the vulnerable method with user input. However, if unsafe input reaches the library method, then an attacker can execute arbitrary shell commands on the host machine. Full impact will depend on the permissions of the process running the `discordrb` library and will likely not be total system access. This issue has been addressed in code, but a new release of the `discordrb` gem has not been uploaded to rubygems. This issue is also tracked as `GHSL-2022-094`.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí