CVE-2021-33564

Katalog CVE

CVSS 9.8 · Critical EPSS 72,1%

Kerentanan Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') pada dragonfly project dragonfly. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL when the verify_url option is disabled. This may lead to code execution. The problem occurs because the generate and process features mishandle use of the ImageMagick convert utility.

Rincian

Terbit di NVD

29 Mei 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

EPSS (30 hari)

72,1% peluang dieksploitasi; lebih tinggi dari 99,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/markevans/dragonfly/commit/25399297bb457f7fcf8e3f91e85945b255b111b5 patch · advisory pihak ketiga
• https://github.com/markevans/dragonfly/compare/v1.3.0...v1.4.0 patch · advisory pihak ketiga
• https://github.com/markevans/dragonfly/issues/513 issue tracking · advisory pihak ketiga
• https://github.com/mlr0p/CVE-2021-33564 exploit · advisory pihak ketiga
• https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/master/cves/2021/CVE-2021-33564.yaml exploit · advisory pihak ketiga
• https://zxsecurity.co.nz/research/argunment-injection-ruby-dragonfly/ exploit · advisory pihak ketiga