Vulnerability Report

CVE-2017-10784

Title: Ruby-Lang Ruby RCE

Auth Bypass

Proof Of Concept

No public PoC currently indexed for CVE-2017-10784.

CWE Category CWE-287

Published Date Sep 19, 2017

Modified Date May 13, 2026

Exploit Status Not Found

Score 8.8 CVSS v3.0

Exploit Probability (EPSS)

2.07%

Vulnerability Summary

CVE-2017-10784: The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute arbitrary commands via a crafted user name.

Impacted Vendors

yukihiro_matsumoto 1

ruby-lang 1

Reference Links

http://www.securityfocus.com/bid/100853 http://www.securitytracker.com/id/1039363 http://www.securitytracker.com/id/1042004 https://access.redhat.com/errata/RHSA-2017:3485 https://access.redhat.com/errata/RHSA-2018:0378 https://access.redhat.com/errata/RHSA-2018:0583 https://access.redhat.com/errata/RHSA-2018:0585 https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html https://security.gentoo.org/glsa/201710-18 https://usn.ubuntu.com/3528-1/ https://usn.ubuntu.com/3685-1/ https://www.debian.org/security/2017/dsa-4031 https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-2-8-released/ https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-3-5-released/ https://www.ruby-lang.org/en/news/2017/09/14/webrick-basic-auth-escape-sequence-injection-cve-2017-10784/ http://www.securityfocus.com/bid/100853 http://www.securitytracker.com/id/1039363 http://www.securitytracker.com/id/1042004 https://access.redhat.com/errata/RHSA-2017:3485 https://access.redhat.com/errata/RHSA-2018:0378 https://access.redhat.com/errata/RHSA-2018:0583 https://access.redhat.com/errata/RHSA-2018:0585 https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html https://security.gentoo.org/glsa/201710-18 https://usn.ubuntu.com/3528-1/ https://usn.ubuntu.com/3685-1/ https://www.debian.org/security/2017/dsa-4031 https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-2-8-released/ https://www.ruby-lang.org/en/news/2017/09/14/ruby-2-3-5-released/ https://www.ruby-lang.org/en/news/2017/09/14/webrick-basic-auth-escape-sequence-injection-cve-2017-10784/

CVSS v3.0

Source Entity [email protected]

Severity HIGH

8.8

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

REQUIRED

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2.0

Source Entity [email protected]

Severity HIGH

9.3

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:M/Au:N/C:C/I:C/A:C

Associated Attack Patterns (CAPEC)

Total: Patterns