Remote Command Injection in Arabic Prawn 0.0.1 Ruby Gem

#774 · 2013-12-17

CVE ID(s): CVE-2014-2322

Notified: 2013-12-17

Description:

Allows printing arabic to PDFs generated by prawn

Exploit:

myfile;id;.txt

id would be passed to the command line and executed.

Notes:

Download: http://rubygems.org/gems/Arabic-Prawn

URL: http://www.vapid.dhs.org/advisories/arabic-ruby-gem.html