CVE-2021-28966
📋 TL;DR
This vulnerability allows remote attackers to write arbitrary files to the Windows temporary directory by submitting crafted paths when a Ruby web application processes parameters with TmpDir. It affects Ruby applications running on Windows servers that handle user input. Attackers can potentially achieve remote code execution or data manipulation.
💻 Affected Systems
- Ruby
- Ruby on Rails applications
- Other Ruby web frameworks
📦 What is this software?
Ruby by Ruby Lang
Ruby by Ruby Lang
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data exfiltration, or ransomware deployment.
Likely Case
Arbitrary file write allowing attackers to plant malicious files, modify application behavior, or achieve limited code execution.
If Mitigated
File write limited to temporary directory with proper input validation and file permission restrictions.
🎯 Exploit Status
Exploitation requires web application to process user input with TmpDir. Public HackerOne report demonstrates the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Ruby 3.0.1 and later
Vendor Advisory: https://www.ruby-lang.org/en/news/2021/03/31/ruby-3-0-1-released/
Restart Required: Yes
Instructions:
1. Update Ruby to version 3.0.1 or later. 2. Restart all Ruby applications and services. 3. Verify the patch is applied by checking Ruby version.
🔧 Temporary Workarounds
Input validation and sanitization
allImplement strict input validation for all parameters that could be passed to TmpDir functions.
Application-level file path restrictions
allImplement application logic to restrict file operations to specific directories and validate all file paths.
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block suspicious path patterns in requests.
- Restrict file system permissions for Ruby application user to minimize impact of arbitrary file writes.
🔍 How to Verify
Check if Vulnerable:
Check if Ruby version is 3.0.0 or earlier on Windows and application uses TmpDir with user input.Check Version:
ruby -vVerify Fix Applied:
Verify Ruby version is 3.0.1 or later using 'ruby -v' command.📡 Detection & Monitoring
Log Indicators:
- Unusual file write operations in temporary directories
- Suspicious path patterns in web application logs
Network Indicators:
- HTTP requests containing crafted path parameters targeting TmpDir endpoints
SIEM Query:
source="web_logs" AND (path:*..* OR path:*:* OR path:*\\*) AND endpoint="*tmp*"