CVE-2014-4994

Vulnerability

The gyazo gem version 1.0.0 for Ruby contains a vulnerability in lib/gyazo/client.rb where it creates a temporary file with a predictable name based on Time.now.to_i and Time.now.usec in the /tmp directory [1][3]. This allows a local attacker to perform a symlink attack, writing to an arbitrary file when the gem writes to the temporary file.

Exploitation

A local attacker can predict the temporary filename by observing the system time or brute-forcing the microsecond component. The attacker creates a symbolic link from the predicted path (e.g., /tmp/gyazo_upload__.png) to a target file writable by the user running the gem. When the gem executes and writes to the temporary file, it follows the symlink and overwrites the target file. No special privileges are required beyond local access to the system [3].

Impact

Successful exploitation allows a local attacker to overwrite arbitrary files with the privileges of the user running the gyazo gem. This can lead to data corruption, denial of service, or potential privilege escalation if critical system or user files are overwritten [1][3].

Mitigation

No patched version of the gyazo gem has been released. The gem appears to be unmaintained. Users should avoid using this gem in multi-user environments or ensure that the /tmp directory is configured with the sticky bit and that untrusted users cannot create symlinks. Alternatively, migrate to a different gem that handles temporary files securely [4].