CVE-2021-21305
📋 TL;DR
CarrierWave versions before 1.3.2 and 2.1.1 contain a code injection vulnerability in the #manipulate! method that allows remote code execution. Attackers can craft malicious strings that get executed as Ruby code when applications supply untrusted inputs to mutation options. This affects any Ruby application using vulnerable CarrierWave versions for file uploads.
💻 Affected Systems
- CarrierWave RubyGem
📦 What is this software?
Carrierwave by Carrierwave Project
Carrierwave by Carrierwave Project
⚠️ Risk & Real-World Impact
Worst Case
Full remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
Remote code execution with application user privileges, potentially leading to data exfiltration, backdoor installation, or service disruption.
If Mitigated
Limited impact if input validation prevents untrusted data from reaching the vulnerable method, though risk remains if controls are bypassed.
🎯 Exploit Status
Exploitation requires the application to process untrusted inputs through the vulnerable method, which is common in file upload scenarios.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.3.2 for 1.x branch, 2.1.1 for 2.x branch
Vendor Advisory: https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-cf3w-g86h-35x4
Restart Required: Yes
Instructions:
1. Update Gemfile to specify 'gem "carrierwave", "~> 1.3.2"' for 1.x or 'gem "carrierwave", "~> 2.1.1"' for 2.x. 2. Run 'bundle update carrierwave'. 3. Restart the Ruby application server.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation to ensure mutation options (:read/:write) only contain trusted, whitelisted values.
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all mutation option parameters
- Disable or restrict file upload functionality until patching is possible
🔍 How to Verify
Check if Vulnerable:
Check Gemfile.lock or run 'bundle show carrierwave' to see installed version. If version is <1.3.2 (for 1.x) or <2.1.1 (for 2.x), the system is vulnerable.Check Version:
bundle show carrierwaveVerify Fix Applied:
After updating, verify with 'bundle show carrierwave' that version is >=1.3.2 (1.x) or >=2.1.1 (2.x). Test file upload functionality to ensure it still works.📡 Detection & Monitoring
Log Indicators:
- Unusual Ruby code execution errors in application logs
- Suspicious file upload attempts with malformed parameters
Network Indicators:
- Unusual outbound connections from application servers following file uploads
SIEM Query:
source="application.log" AND ("manipulate!" OR "CarrierWave" OR "RCE")🔗 References
- https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#132---2021-02-08
- https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#211---2021-02-08
- https://github.com/carrierwaveuploader/carrierwave/commit/387116f5c72efa42bc3938d946b4c8d2f22181b7
- https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-cf3w-g86h-35x4
- https://rubygems.org/gems/carrierwave
- https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#132---2021-02-08
- https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md#211---2021-02-08
- https://github.com/carrierwaveuploader/carrierwave/commit/387116f5c72efa42bc3938d946b4c8d2f22181b7
- https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-cf3w-g86h-35x4
- https://rubygems.org/gems/carrierwave
