Description
The message function in lib/webbynode/notify.rb in the Webbynode gem 1.0.5.3 and earlier for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a growlnotify message.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | webbynode | <= 1.0.5.3 | — | GHSA-p65m-qr5x-rrqq |
References
- http://www.vapid.dhs.org/advisories/webbynode-command-inj.html
- [oss-security] 20131212 Command injection in Ruby Gem Webbynode 1.0.5.3 mailing-list
- https://github.com/webbynode/webbynode/pull/85
- http://packetstormsecurity.com/files/124421
- webbynode-cve20137086-command-exec(89705) vdb-entry
- 20131214 Command injection in Ruby Gem Webbynode 1.0.5.3 mailing-list
- 100920 vdb-entry
- 64289 vdb-entry
- [oss-security] 20131212 Re: Command injection in Ruby Gem Webbynode 1.0.5.3 mailing-list