CVE-2021-21288GHSA-FWCM-636P-68R5
Server-side request forgery in CarrierWave
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.3.2, 2.1.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1 the download feature has an SSRF vulnerability, allowing attacks to provide DNS entries or IP addresses that are intended for internal use and gather information about the Intranet infrastructure of the platform. This is fixed in versions 1.3.2 and 2.1.1.
Timeline
- CVE published
- Record last updated
Affected versions
- carrierwaveuploader carrierwave
fixed in 1.3.2; From 2.0.0 · fixed in 2.1.1
- carrierwaveRubyGems
fixed in 1.3.2
- carrierwaveRubyGems
From 2.0.0 · fixed in 2.1.1