Description
WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel 248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | ruby +8 | 1.8.5-19.el5_6.1 | RHSA-2011:0909 |
| RHEL 4 | irb +6 | 1.8.1-16.el4 | RHSA-2011:0908 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Ruby 1.9.1 - WEBrick 'Terminal Escape Sequence in Logs' Command Injection EDB-33489 · remote · Jan 11, 2010 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | webrick | < 1.4.0 | 1.4.0 | GHSA-6mq2-37j5-w6r6 |
Advisories 2
- RHSA-2011:0908 Red Hat Security Advisory: ruby security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2011:0909 Red Hat Security Advisory: ruby security update Red Hat Security Advisories (RHSA) · May 9, 2026
References
- http://www.ruby-lang.org/en/news/2010/01/10/webrick-escape-sequence-injection
- RHSA-2011:0909 vendor-advisory
- 37949 third-party-advisory
- ADV-2010-0089 vdb-entry
- RHSA-2011:0908 vendor-advisory
- http://www.ush.it/team/ush/hack_httpd_escape/adv.txt
- 37710 vdb-entry
- 20100110 Nginx, Varnish, Cherokee, thttpd, mini-httpd, WEBrick, Orion, AOLserver, Yaws and Boa log escape sequence injection mailing-list
- 1023429 vdb-entry