CVE-2017-17790

Vulnerability

The lazy_initialize function in lib/resolv.rb in Ruby through version 2.4.3 uses Kernel#open, which might allow command injection attacks. This is demonstrated by a Resolv::Hosts::new argument beginning with a '|' character [1][2][3][4]. The issue is a different vulnerability than CVE-2017-17405.

Exploitation

An attacker must provide a crafted argument to Resolv::Hosts.new that starts with a '|' character. The Kernel#open call interprets the argument as a pipe command if it begins with '|', leading to execution of arbitrary shell commands. The scenario with untrusted input is considered highly unlikely by the advisory [1].

Impact

Successful exploitation results in arbitrary command execution with the privileges of the Ruby process. This can lead to full compromise of the affected application or system.

Mitigation

Red Hat has released updated packages for various Ruby versions: ruby-2.0.0.648-33.el7_4 for RHEL Server 7 [1], rh-ruby23-ruby (2.3.6) [2], rh-ruby24-ruby (2.4.3) [3], and rh-ruby22-ruby (2.2.9) [4]. Users should update to the fixed versions. No workaround is provided for versions without a patch.