Janko Marohnić

3 exploits Active since Jul 2019
CVE-2019-13574 WRITEUP HIGH WRITEUP
MiniMagick < 4.9.4 - Remote Code Execution via Image.open Kernel#open Command Injection
In lib/mini_magick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.open input is directly passed to Kernel#open, which accepts a '|' character followed by a command.
CVSS 7.8
CVE-2020-15237 WRITEUP MEDIUM WRITEUP
Shrine < 3.3.0 - Observable Timing Discrepancy in Derivation Endpoint Signature Verification
In Shrine before version 3.3.0, when using the `derivation_endpoint` plugin, it's possible for the attacker to use a timing attack to guess the signature of the derivation URL. The problem has been fixed by comparing sent and calculated signature in constant time, using `Rack::Utils.secure_compare`. Users using the `derivation_endpoint` plugin are urged to upgrade to Shrine 3.3.0 or greater. A possible workaround is provided in the linked advisory.
CVSS 5.9
CVE-2022-24720 WRITEUP CRITICAL WRITEUP
image_processing <1.12.2 - Command Injection
image_processing is an image processing wrapper for libvips and ImageMagick/GraphicsMagick. Prior to version 1.12.2, using the `#apply` method from image_processing to apply a series of operations that are coming from unsanitized user input allows the attacker to execute shell commands. This method is called internally by Active Storage variants, so Active Storage is vulnerable as well. The vulnerability has been fixed in version 1.12.2 of image_processing. As a workaround, users who process based on user input should always sanitize the user input by allowing only a constrained set of operations.
CVSS 9.8