CVE-2017-17405

EIP tracks 1 public exploit for CVE-2017-17405. PoCs published by Etienne Stalmans.

AI-analyzed exploit summary This exploit demonstrates a command injection vulnerability in Ruby's NET::FTP library (CVE-2017-17405) where malicious filenames containing shell metacharacters (e.g., `| id`) can trigger arbitrary command execution when processed by the `gettextfile` method. The PoC includes a custom FTP server that serves a malicious filename and a client script that downloads it, resulting in RCE.

Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a local file. If the localfile argument starts with the "|" pipe character, the command following the pipe character is executed. The default value of localfile is File.basename(remotefile), so malicious FTP servers could cause arbitrary command execution.