A critical vulnerability (CVE-2022-29176) has been identified in the RubyGems.org package repository, allowing unauthorized users to replace certain foreign packages in the repository by initiating the yank of a legitimate package and uploading another file with the same name and version number in its place.
Three conditions must be met for successful exploitation of the vulnerability:
- The attack can only be carried out on packages that contain a hyphen in their name.
- The attacker must be able to publish a gem package with part of the name before the hyphen. For example, if the attack is aimed at the package 'rails-html-sanitizer', the attacker must publish their own package 'rails-html' in the repository.
- The target package must have been created in the last 30 days or not updated for 100 days.
The vulnerability arises from an error in the yank action handler, which interprets the part of the name after the hyphen as the platform name, allowing for the initiation of the removal of foreign packages that match the name up to the hyphen. Specifically, in the yank operation handler code, the package search used the call 'find_by!(full_name: "#{rubygem.name}-#{slug}")', where the 'slug' parameter was provided by the package owner to determine the version to be removed. The owner of the 'rails-html' package could specify 'sanitizer-1.2.3' instead of version '1.2.3', leading to the operation being applied to the foreign package 'rails-html-sanitizer-1.2.3'.
The issue was discovered by a security researcher as part of an ongoing HackerOne bug bounty program for identifying security issues in well-known open projects. The issue was resolved in RubyGems.org on May 5, and according to the developers, they have not yet detected any signs of exploitation of the vulnerability in the logs for the past 18 months. However, only a superficial audit has been performed so far, and a more in-depth inspection is planned for the future.
To verify your projects, it is advisable to analyze the operation history in the Gemfile.lock file. Malicious activity is indicated by changes that maintain the name and version, or by switching platforms (for example, when the gemname-1.2.3 package is updated to gemname-1.2.3-java). As a workaround to protect against hidden package replacement in continuous integration systems or when publishing projects, developers are recommended to use Bundler with the "--frozen" or "--deployment" options to lock dependencies.
Source: opennet.ru
