CVE-2021-31810: 
Ruby vulnerability analysis and mitigation

A vulnerability was discovered in Ruby through versions 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. The vulnerability (CVE-2021-31810) allows a malicious FTP server to use the PASV response to trick Net::FTP into connecting back to a given IP address and port (Ruby News, NVD).

The vulnerability exists in the Net::FTP module's handling of PASV responses. When a malicious FTP server sends a crafted PASV response, it can manipulate the Net::FTP client into establishing connections to arbitrary IP addresses and ports. The vulnerability has been assigned a CVSS v3.1 base score of 5.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N (NVD).

The successful exploitation of this vulnerability could allow attackers to conduct port scans and extract service banner information from otherwise private and undisclosed services. This potentially enables attackers to gather information about internal network services that should not be accessible externally (Ruby News).

The vulnerability can be exploited remotely by a malicious FTP server without requiring any user interaction or special privileges. The attack complexity is considered low, as it only requires the ability to control an FTP server and send crafted PASV responses (NVD).

The vulnerability has been fixed in newer versions of Ruby. Users are strongly recommended to upgrade to patched versions. For Ruby 2.6 series: versions after 2.6.7, Ruby 2.7 series: versions after 2.7.3, and Ruby 3.0 series: versions after 3.0.1. Note that while net-ftp is a default gem in Ruby 3.0.1, it has a packaging issue, so users should upgrade Ruby itself rather than just the gem (Ruby News).

Multiple organizations and vendors have acknowledged this vulnerability and released security advisories, including NetApp, Oracle, and various Linux distributions. The vulnerability has been included in security updates for numerous enterprise systems and applications (NetApp Advisory, Oracle Alert).