Vulnerability Description
An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL when the verify_url option is disabled. This may lead to code execution. The problem occurs because the generate and process features mishandle use of the ImageMagick convert utility.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Dragonfly Project | Dragonfly | < 1.4.0 |
Related Weaknesses (CWE)
References
- https://github.com/markevans/dragonfly/commit/25399297bb457f7fcf8e3f91e85945b255PatchThird Party Advisory
- https://github.com/markevans/dragonfly/compare/v1.3.0...v1.4.0PatchThird Party Advisory
- https://github.com/markevans/dragonfly/issues/513Issue TrackingThird Party Advisory
- https://github.com/mlr0p/CVE-2021-33564ExploitThird Party Advisory
- https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/master/cves/ExploitThird Party Advisory
- https://zxsecurity.co.nz/research/argunment-injection-ruby-dragonfly/ExploitThird Party Advisory
- https://github.com/markevans/dragonfly/commit/25399297bb457f7fcf8e3f91e85945b255PatchThird Party Advisory
- https://github.com/markevans/dragonfly/compare/v1.3.0...v1.4.0PatchThird Party Advisory
- https://github.com/markevans/dragonfly/issues/513Issue TrackingThird Party Advisory
- https://github.com/mlr0p/CVE-2021-33564ExploitThird Party Advisory
- https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/master/cves/ExploitThird Party Advisory
- https://zxsecurity.co.nz/research/argunment-injection-ruby-dragonfly/ExploitThird Party Advisory
FAQ
What is CVE-2021-33564?
CVE-2021-33564 is a vulnerability with a CVSS score of 9.8 (CRITICAL). An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL when the verify_url option is disabled. Th...
How severe is CVE-2021-33564?
CVE-2021-33564 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2021-33564?
Check the references section above for vendor advisories and patch information. Affected products include: Dragonfly Project Dragonfly.