Log in Start free

Vulnerability · Published Feb 2, 2021 · Assigned by GitHub_M

CVE-2021-21289Command Injection Vulnerability in Mechanize

High 7.4

In plain English

A high-severity OS command injection in mechanize from sparklemotion. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.5% (higher than 89% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.4High
Exploit odds (30 days)3.5%top 10.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize from version 2.0.0 and before version 2.7.7 there is a command injection vulnerability. Affected versions of mechanize allow for OS commands to be injected using several classes' methods which implicitly use Ruby's Kernel.open method. Exploitation is possible only if untrusted input is used as a local filename and passed to any of these calls: Mechanize::CookieJar#load, Mechanize::CookieJar#save_as, Mechanize#download, Mechanize::Download#save, Mechanize::File#save, and Mechanize::FileResponse#read_body. This is fixed in version 2.7.7.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12ruby-mechanize2.7.7-1DEBIAN-CVE-2021-21289
Debian:13ruby-mechanize2.7.7-1DEBIAN-CVE-2021-21289
Debian:14ruby-mechanize2.7.7-1DEBIAN-CVE-2021-21289
RubyGemsmechanize2.7.7GHSA-qrqm-fpv6-6r8g
Ubuntu:22.04:LTSruby-mechanizeno fix listedUBUNTU-CVE-2021-21289

Affected products (as reported)

VendorProductVersions
sparklemotion mechanize >= 2.0, < 2.7.7

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

References