Description
lib/entry_controller.rb in the fastreader Gem 1.0.8 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | fastreader | >= 1.0.0 | — | GHSA-w248-xr37-jx8m |
References
- 20130312 Ruby gem fastreader-1.0.8 remote code exec mailing-list
- 91232 vdb-entry
- http://packetstormsecurity.com/files/120845/Ruby-Gem-Fastreader-1.0.8-Code-Execution.html
- http://packetstormsecurity.com/files/120776/Ruby-Gem-Fastreader-1.0.8-Command-Execution.html
- [oss-security] 20130319 Fwd: CVE requests mailing-list