CVE-2021-21305

Description

CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1, there is a code injection vulnerability. The "#manipulate!" method inappropriately evals the content of mutation option(:read/:write), allowing attackers to craft a string that can be executed as a Ruby code. If an application developer supplies untrusted inputs to the option, it will lead to remote code execution(RCE). This is fixed in versions 1.3.2 and 2.1.1.

Weakness classification

• security-advisories@github.com: CWE-74
• nvd@nist.gov: CWE-94

Primary references

• security-advisories@github.com — Release Notes, Third Party Advisory
• security-advisories@github.com — Release Notes, Third Party Advisory
• security-advisories@github.com — Patch, Third Party Advisory
• security-advisories@github.com — Exploit, Third Party Advisory
• security-advisories@github.com — Product, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Product, Third Party Advisory