Vulnerabilities in RDoc and StringIO

0

Attackers can execute their own code in the Ruby program
Vulnerability in Ruby gems allows data theft

Providers on the topic

There are currently vulnerabilities in RDoc and StringIO gems that allow attackers to execute code in the Ruby program. This makes cyber attacks and data theft possible. An update is available.

The RDoc and StringIO gem vulnerabilities allow attackers to execute code and steal data.

(Image: Maximusdn – stock.adobe.com)

Developers who rely on the Ruby gems RDoc and StringIO are currently confronted with two security vulnerabilities. It is generally recommended to check and update the version used.

CVE-2024-27281: RCE .rdoc_options vulnerability in RDoc

An issue was discovered in RDoc 6.3.3 through 6.6.2 as provided in Ruby 3.x through 3.3.0. When parsing .rdoc_options (used for configuration in RDoc) as a YAML file, object injection and resulting remote code execution are possible because there are no restrictions on the classes that can be restored. When loading the documentation cache, object injection and resulting remote code execution are also possible if there is a tampered cache.

This allows attackers to exploit the gap CVE-2024-27281 exploit in RDoc. Here attackers can inject their own code and execute it in the context of the corresponding program. Those affected are:

  • RDoc according to 6.3.3 or older, 6.4.0 to 6.6.2 without installed updates (6.3.4, 6.4.1, 6.5.1)

As of versions 6.3.4.1 in Ruby 3.0 and 6.4.1.1 in Ruby 3.1, the gap is closed.

CVE-2024-27280: Buffer overread vulnerability in StringIO

Another problem was discovered in StringIO 3.0.1, especially Ruby 3.0.x to 3.0.6 and 3.1.x to 3.1.4. The NichtByte and NichtTC methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets can return the stored value. This vulnerability does not affect StringIO 3.0.3 and later and Ruby 3.2.x and later.

This can lead to a buffer overread with the Gem StringIO. This is caused by the discovered gap CVE-2024-27280. There is also a separate entry for this in the Ruby news section. The system unintentionally passes on data. This allows attackers to read secret information. Together with the CVE-2024-27281 vulnerability, attackers can inject code and read information based on this code or with other actions. Those affected are:

  • StringIO according to 3.0.2 or older

(ID:49979519)

source site