CVE-2020-14001
📋 TL;DR
The kramdown gem before version 2.3.0 for Ruby processes template options inside Kramdown documents by default, allowing attackers to read arbitrary files or execute embedded Ruby code. This affects all applications using vulnerable kramdown versions, including Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum.
💻 Affected Systems
- kramdown
- Jekyll
- GitLab Pages
- GitHub Pages
- Thredded Forum
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Kramdown by Kramdown Project
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Unauthorized file access exposing sensitive configuration files, credentials, or user data.
If Mitigated
Limited impact with proper input validation and sandboxing in place.
🎯 Exploit Status
Exploitation requires ability to submit Kramdown content for processing. Public proof-of-concept demonstrates file read and code execution.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.3.0
Vendor Advisory: https://kramdown.gettalong.org/news.html
Restart Required: No
Instructions:
1. Update kramdown gem: gem update kramdown
2. Verify version: gem list kramdown
3. Update Gemfile to specify 'kramdown', '>= 2.3.0'
4. Run bundle update kramdown if using Bundler
🔧 Temporary Workarounds
Disable template processing
allConfigure kramdown to disable template option processing
Set Kramdown::Document.new(input, template: false) in code
Input sanitization
allStrip or reject Kramdown input containing template= patterns
Use regex: input.gsub(/template\s*=\s*["'][^"']*["']/, '')
🧯 If You Can't Patch
- Implement strict input validation to reject Kramdown containing template= patterns
- Run kramdown in isolated sandbox/container with minimal permissions
🔍 How to Verify
Check if Vulnerable:
Check kramdown version: gem list | grep kramdown or bundle show kramdownCheck Version:
gem list kramdown | grep -o 'kramdown ([^)]*)'Verify Fix Applied:
Confirm version is 2.3.0 or higher: kramdown --version📡 Detection & Monitoring
Log Indicators:
- Kramdown processing errors
- Unexpected file read attempts
- Ruby code execution in kramdown context
Network Indicators:
- HTTP requests with Kramdown content containing template= patterns
SIEM Query:
source="application" AND ("template=" OR "kramdown" AND error)🔗 References
- https://github.com/gettalong/kramdown
- https://github.com/gettalong/kramdown/commit/1b8fd33c3120bfc6e5164b449e2c2fc9c9306fde
- https://github.com/gettalong/kramdown/compare/REL_2_2_1...REL_2_3_0
- https://kramdown.gettalong.org
- https://kramdown.gettalong.org/news.html
- https://lists.apache.org/thread.html/r96df7899fbb456fe2705882f710a0c8e8614b573fbffd8d12e3f54d2%40%3Cnotifications.fluo.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2020/08/msg00014.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ENMMGKHRQIZ3QKGOMBBBGB6B4LB5I7NQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KBLTGBYU7NKOUOHDKVCU4GFZMGA6BP4L/
- https://rubygems.org/gems/kramdown
- https://security.netapp.com/advisory/ntap-20200731-0004/
- https://usn.ubuntu.com/4562-1/
- https://www.debian.org/security/2020/dsa-4743
- https://github.com/gettalong/kramdown
- https://github.com/gettalong/kramdown/commit/1b8fd33c3120bfc6e5164b449e2c2fc9c9306fde
- https://github.com/gettalong/kramdown/compare/REL_2_2_1...REL_2_3_0
- https://kramdown.gettalong.org
- https://kramdown.gettalong.org/news.html
- https://lists.apache.org/thread.html/r96df7899fbb456fe2705882f710a0c8e8614b573fbffd8d12e3f54d2%40%3Cnotifications.fluo.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2020/08/msg00014.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ENMMGKHRQIZ3QKGOMBBBGB6B4LB5I7NQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KBLTGBYU7NKOUOHDKVCU4GFZMGA6BP4L/
- https://rubygems.org/gems/kramdown
- https://security.netapp.com/advisory/ntap-20200731-0004/
- https://usn.ubuntu.com/4562-1/
- https://www.debian.org/security/2020/dsa-4743
