Arbitrary Command Injection

Overview bitcoinrb is an implementation of Bitcoin Protocol for Ruby Affected versions of this package are vulnerable to Arbitrary Command Injection via the send function in rpc/httpserver.rb, which runs as part of the experimental SPV node feature. An attacker can execute arbitrary system comman...

Bitcoinrb Vulnerable to Command injection via RPC

Summary: Remote Code Execution Unsafe handling of request parameters in the RPC HTTP server results in command injection Details In lib/bitcoin/rpc/httpserver.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is...