Vulnerability record · CVE-2017-17405 · published 15 December 2017
CVE-2017-17405: Ruby Net::FTP local file handling allows command injection
Ruby Lang · Ruby
Ruby before 2.4.3 lets Net::FTP methods (get, getbinaryfile, gettextfile, put, putbinaryfile, puttextfile) pass the localfile argument to Kernel#open. If localfile begins with the "|" pipe character, the following command is executed, and since localfile defaults to File.basename(remotefile), a malicious FTP server can trigger arbitrary command execution.
Description
Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a local file. If the localfile argument starts with the "|" pipe character, the command following the pipe character is executed. The default value of localfile is File.basename(remotefile), so malicious FTP servers could cause arbitrary command execution.
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
high priorityNetwork-reachable command injection with a public exploit and very high EPSS, though it requires user interaction and a malicious FTP server.
What it is
Ruby before 2.4.3 lets Net::FTP methods (get, getbinaryfile, gettextfile, put, putbinaryfile, puttextfile) pass the localfile argument to Kernel#open. If localfile begins with the "|" pipe character, the following command is executed, and since localfile defaults to File.basename(remotefile), a malicious FTP server can trigger arbitrary command execution.
Impact
An attacker controlling the FTP server can execute arbitrary commands with the privileges of the Ruby process on the connecting client.
Attack surface
Reached over the network when a Ruby application connects to an attacker-controlled FTP server and calls the affected Net::FTP methods; the CVSS vector indicates no privileges required but user interaction is required.
Exploitation
Not listed in CISA KEV, but EPSS is very high (0.73829, 99.45th percentile) and a public Exploit-DB entry (43381) exists, indicating known exploit code is available.
What to do
- Upgrade Ruby to 2.4.3 or later, or apply the vendor patch for your distribution (Red Hat RHSA-2018:0378/0583/0584/0585/2806, Debian DSA-4259).
- Avoid passing untrusted or server-derived values as the localfile argument to Net::FTP methods.
- Do not connect to untrusted FTP servers from Ruby code using the affected methods.
- Where feasible, replace Net::FTP usage with a client that does not route local paths through Kernel#open.
Detection
- Monitor Ruby processes for unexpected child process execution, especially shells or commands spawned from FTP client activity.
- Audit application code and logs for Net::FTP calls where localfile derives from a remote filename.
- Watch outbound FTP connections to untrusted or unexpected servers from hosts running Ruby.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
8 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2017-17405 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2017-17405), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
