CVE-2021-31810: Infoleak
A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes Net::FTP extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions).
References:
https://www.ruby-lang.org/en/news/2021/07/07/trusting-pasv-responses-in-net-ftp/
Other sources
An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions).
Ruby's Net::FTP module trusted the IP address included in the FTP server's response to the PASV command. A malicious FTP server could use this to make Ruby applications using the Net::FTP module to connect to arbitrary hosts and use this to perform port scanning or information extraction from systems not accessible from the FTP server.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2021-31810.
What is the severity of CVE-2021-31810?
The severity of CVE-2021-31810 is medium with a severity value of 5.4.
What is the affected software for CVE-2021-31810?
The affected software for CVE-2021-31810 is Ruby versions 2.6.7 through 2.6.8, 2.7.x through 2.7.3, and 3.x through 3.0.1.
How can a malicious FTP server exploit CVE-2021-31810?
A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port.
Is there a fix available for CVE-2021-31810?
Yes, the fix for CVE-2021-31810 is to update to Ruby version 3.0.2.