CVE-2017-17405

What it actually does

Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile pass the localfile argument (defaulting to File.basename(remotefile)) directly to Kernel#open; a leading pipe character causes arbitrary command execution instead of file access.

Why it matters to the business

Systems using affected Ruby versions for FTP file transfers can be fully compromised by a malicious server, resulting in remote code execution, data theft, or deployment of malware across the environment.

How an attack unfolds

An attacker hosts a malicious FTP server; when a vulnerable Ruby client performs any of the listed file operations, the server supplies a remotefile whose basename begins with a pipe followed by a command, which Kernel#open executes with the privileges of the Ruby process.

How to fix it

Upgrade Ruby to version 2.4.3 or later on all affected systems; replace direct use of Net::FTP#get/put family methods with safer file-handling libraries that do not invoke the shell; restrict connections to trusted FTP servers only.

How to confirm the fix worked

Confirm Ruby version is 2.4.3 or newer; attempt a test transfer with a localfile argument beginning with '|' and verify the command is not executed; scan application code for calls to the affected Net::FTP methods.

Typical attack path

1. Attacker deploys malicious FTP server that returns crafted remotefile names
2. Victim Ruby application initiates Net::FTP connection and file transfer
3. Net::FTP derives localfile from File.basename(remotefile) containing leading pipe
4. Kernel#open executes the command following the pipe
5. Attacker gains arbitrary command execution on the victim host

How to detect it

Review Ruby process execution logs and system audit trails for child processes spawned unexpectedly during FTP operations; search application logs for FTP file names containing pipe characters; inspect network traffic for connections to unknown FTP endpoints.

What your security team should do

• Prioritize upgrade of all Ruby installations to 2.4.3+ due to high EPSS and public exploit availability
• Inventory and review all code paths that perform FTP file operations
• Implement network controls to block outbound connections to untrusted FTP servers
• Monitor for new Ruby releases and apply patches within standard change windows