Miggo Logo
Miggo Vulnerability Database
→
CVE-2019-5477

CVE-2019-5477: Nokogiri Command Injection Vulnerability

9.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2019-5477
GHSA ID
GHSA-cr5j-953j-xw5p
EPSS Score
0.77529%
CWE
CWE-78
Published
8/19/2019
Updated
8/28/2023
KEV Status
No
Technology
TechnologyRuby

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
nokogirirubygems< 1.10.41.10.4
rexicalrubygems< 1.0.71.0.7

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability description explicitly identifies Nokogiri::CSS::Tokenizer#load_file as the entry point when processing untrusted filenames. The commit diff shows this method originally used Kernel.open(filename), which executes shell commands when given pipe operators. The patch changes this to File.open(filename), which is safe. The Rexical-generated code (tokenizer.rex) produced this vulnerable implementation, but the direct vulnerable function in Nokogiri is clearly identified in the Tokenizer class.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* *omm*n* inj**tion vuln*r**ility in Noko*iri v*.**.* *n* **rli*r *llows *omm*n*s to ** *x**ut** in * su*pro**ss vi* Ru*y's `K*rn*l.op*n` m*t*o*. Pro**ss*s *r* vuln*r**l* only i* t** un*o*um*nt** m*t*o* `Noko*iri::*SS::Tok*niz*r#lo**_*il*` is **in* *

Reasoning

T** vuln*r**ility **s*ription *xpli*itly i**nti*i*s `Noko*iri::*SS::Tok*niz*r#lo**_*il*` *s t** *ntry point w**n pro**ssin* untrust** *il*n*m*s. T** *ommit *i** s*ows t*is m*t*o* ori*in*lly us** `K*rn*l.op*n(*il*n*m*)`, w*i** *x**ut*s s**ll *omm*n*s