CVE-2017-10784: Escape sequence injection vulnerability in the Basic authentication of WEBrick

[André Arko]

There is an escape sequence injection vulnerabirity in the Basic authentication of WEBrick bundled by Ruby. This vulnerability has been assgined the CVE identifier CVE-2017-10784.

Details

When using the Basic authentication of WEBrick, clients can pass an arbitrary string as the user name. WEBrick outputs the passed user name intact to its log, then an attacker can inject malcious escape sequences to the log and dangerours control characters may be executed on a victim’s terminal emulator.

This vulnerability is similar to a vulnerability already fixed, but it had not been fixed in the Basic authentication.

All users running an affected release should upgrade immediately.

Affected Versions

• Ruby 2.2 series: 2.2.7 and earlier
• Ruby 2.3 series: 2.3.4 and earlier
• Ruby 2.4 series: 2.4.1 and earlier
• prior to trunk revision 58453
Credit

Thanks to Yusuke Endoh ma...@ruby-lang.org for reporting this issue.

History

• Originally published at 2017-09-14 12:00:00 (UTC)
Posted by usa on 14 Sep 2017