CVE-2021-31810 in Ruby
Summary
by MITRE • 07/13/2021
An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 05/09/2026
The vulnerability identified as CVE-2021-31810 represents a significant security flaw in Ruby's Net::FTP implementation that enables remote attackers to manipulate network connections through malicious FTP server responses. This issue affects Ruby versions up to 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1, making it a widespread concern across multiple Ruby release lines. The vulnerability stems from improper handling of the PASV (Passive) response command during FTP connections, which creates a fundamental flaw in the protocol implementation that can be exploited by malicious actors.
The technical flaw occurs when Net::FTP processes the PASV response from an FTP server, where the server provides an IP address and port number that the client should connect to for data transfer. In this case, a malicious FTP server can manipulate the IP address and port information within the PASV response to redirect the client connection to arbitrary targets. The vulnerability specifically exploits the lack of proper validation and sanitization of the IP address information provided in the PASV response, allowing attackers to specify any IP address and port combination. This flaw operates at the network protocol level where the FTP client blindly trusts and connects to the IP address and port provided by the server without adequate verification mechanisms.
The operational impact of this vulnerability extends beyond simple information disclosure to enable active reconnaissance and network scanning capabilities. Attackers can leverage this vulnerability to perform port scans against internal services that would normally be protected behind firewalls or network segmentation, as the malicious FTP server can redirect connections to private network addresses. This capability allows for service banner extraction and detailed network mapping of internal systems that should remain hidden from external access. The vulnerability essentially enables a form of covert reconnaissance where attackers can probe internal network services without direct exposure, making it particularly dangerous in environments where internal network security is paramount.
This vulnerability aligns with CWE-20, which addresses improper input validation, and maps to several ATT&CK techniques including T1046 for network service scanning and T1041 for exfiltration. The attack chain typically begins with establishing an FTP connection to a malicious server, followed by manipulation of the PASV response to redirect traffic to target systems. Organizations should implement immediate mitigations including updating to patched Ruby versions, implementing network segmentation to isolate FTP traffic, and deploying network monitoring solutions to detect anomalous connection patterns. Additionally, organizations should consider implementing firewall rules that restrict FTP data connection behavior and establish proper network access controls to prevent unauthorized redirection of FTP traffic to internal systems. The vulnerability demonstrates the critical importance of proper input validation in network protocol implementations and highlights the need for robust security practices in all network communication components.