CVE-2021-28966

Vulnerability

A path traversal vulnerability exists in Ruby's tmpdir library through version 3.0 on Windows. The Dir.mktmpdir method, when handling parameters, does not sufficiently sanitize user-supplied prefix/suffix strings, allowing a remote attacker to pass a crafted path containing directory traversal sequences (e.g., ..\\). This affects applications that pass untrusted user input as the prefix or suffix argument to Dir.mktmpdir. The issue is documented in references [1] and [3].

Exploitation

An attacker must be able to supply a string that is used as the prefix or suffix argument to Dir.mktmpdir. This typically occurs in web applications that handle file uploads or create temporary directories based on user-controlled parameters. A remote attacker can submit a parameter with path traversal characters (e.g., ../../malicious) to force the temporary directory to be created outside the intended location. No authentication is required beyond access to the vulnerable parameter. The exploit sequence is: the attacker sends a crafted request with a malicious prefix/suffix, the application calls Dir.mktmpdir with that input, and the directory is created at an attacker-controlled path [1].

Impact

Successful exploitation allows an attacker to create a directory at an arbitrary location on the filesystem. This can lead to unauthorized file writes or overwriting of existing files, potentially enabling privilege escalation, denial of service, or arbitrary code execution depending on where the directory is created and how it is used by the application. The confidentiality, integrity, and availability of the system may be compromised [1].

Mitigation

A fix was merged into the ruby/tmpdir repository on April 5, 2021, with commit 93798c0, which tightened character restrictions to only allow alphanumeric and filesystem-safe punctuation [2]. Users should update to a version of Ruby that includes this patch, or directly update the tmpdir gem to a version containing the fix. The Ruby advisory database [3] provides details on the vulnerable versions (Ruby through 3.0 on Windows). As of the publication date (2021-07-27), no official Ruby patch release is announced; users should monitor for updates.