Back to KEVs

CVE-2021-33564

An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a...

Basic Information

CVE State
PUBLISHED
Reserved Date
May 24, 2021
Published Date
May 29, 2021
Last Updated
August 03, 2024
Vendor
markevans
Product
dragonfly
Description
An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL when the verify_url option is disabled. This may lead to code execution. The problem occurs because the generate and process features mishandle use of the ImageMagick convert utility.
Tags
nuclei_scanner ruby

CVSS Scores

CVSS v3.1

9.8 - CRITICAL

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

6.8

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS Score

Score
91.23% (Percentile: 99.63%) as of 2025-07-17

Exploit Status

Exploited in the Wild
Yes (2025-06-30 00:00:00 UTC) Source

References

https://github.com/markevans/dragonfly/issues/513 https://github.com/markevans/dragonfly/commit/25399297bb457f7fcf8e3f91e85945b255b111b5 https://github.com/markevans/dragonfly/compare/v1.3.0...v1.4.0 https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/master/cves/2021/CVE-2021-33564.yaml https://github.com/mlr0p/CVE-2021-33564 https://zxsecurity.co.nz/research/argunment-injection-ruby-dragonfly/

Known Exploited Vulnerability Information

Source Added Date
The Shadowserver (via CIRCL) 2025-07-01 12:00:43 UTC

Scanner Integrations

Scanner URL Date Detected
Nuclei https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-33564.yaml 2025-04-26 00:00:00 UTC

Potential Proof of Concepts

Warning: These PoCs have not been tested and could contain malware. Use at your own risk.

mlr0p/CVE-2021-33564

Type: github • Created: 2021-05-25 02:48:08 UTC • Stars: 16

Argument Injection in Dragonfly Ruby Gem

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Detected by Nuclei

  • Added to KEVIntel