CVE-2021-33564

CRITICAL EXPLOITED IN THE WILD NUCLEI

Dragonfly <1.4.0 - Command Injection

Title source: llm
STIX 2.1

Description

An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL when the verify_url option is disabled. This may lead to code execution. The problem occurs because the generate and process features mishandle use of the ImageMagick convert utility.

Exploits (2)

nomisec WORKING POC 16 stars
by mlr0p · remote
https://github.com/mlr0p/CVE-2021-33564
nomisec WORKING POC
by dorkerdevil · remote
https://github.com/dorkerdevil/CVE-2021-33564

Nuclei Templates (1)

Ruby Dragonfly <1.4.0 - Remote Code Execution
CRITICALby 0xsapra

References (6)

Scores

CVSS v3 9.8
EPSS 0.9336
EPSS Percentile 99.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

VulnCheck KEV 2023-11-29
InTheWild.io 2021-04-12
CWE
CWE-88
Status published
Products (2)
dragonfly_project/dragonfly < 1.4.0
rubygems/dragonfly 0 - 1.4.0RubyGems
Published May 29, 2021
Tracked Since Feb 18, 2026