Ruby CVE-2017-17405: Vulnerability in Ruby’s FTP Implementation

Summary

CVE-2017-17405 affected Ruby’s net/ftp implementation, where a filename returned by an FTP server could reach Ruby’s open function and enable command execution. The issue was found while investigating CVE-2017-8817 in libcurl and checking whether Ruby used libcurl or had a separate FTP implementation with comparable wildcard behavior. Reviewing Ruby 2.4.2 source identified the 1,496-line ftp.rb file and the gettextfile method, which called open(localfile, "w") without validating the value. A proof of concept made an FTP client request a file list containing a pipe-prefixed payload; Ruby passed it to the shell, producing remote code execution and creating a file containing id output. Ruby replaced open with File.open, released the fix in 2.4.3, and assigned CVE-2017-17405; affected versions included Ruby 2.2.8 and earlier, 2.3.5 and earlier, 2.4.2 and earlier, and 2.5.0-preview1.

Takeaways

1. 1

   Ruby’s net/ftp library used open(localfile, "w") in gettextfile, allowing a server-controlled filename beginning with | to trigger command execution.

2. 2

   The proof of concept returned a payload through an FTP NLIST response and caused the connecting client to run echo $(id) > pang.

3. 3

   The fix replaced open with File.open and shipped in Ruby 2.4.3; affected branches included Ruby 2.2.8 and earlier, 2.3.5 and earlier, 2.4.2 and earlier, and Ruby 2.5.0-preview1.