Malicious code detected in rest-client and 10 other Ruby packages

In the popular gem package rest-client, which has a total of 113 million downloads, identified malicious code injection (CVE-2019-15224), which downloads executable commands and sends information to an external host. The attack occurred through compromise of the developer account of rest-client in the rubygems.org repository, after which attackers published versions 1.6.10-1.6.13 on August 13 and 14, with malicious changes included. About a thousand users managed to download the malicious versions before they were blocked (the attackers released updates for older versions to avoid drawing attention).

The malicious change overrides the ‘#authenticate’ method in the class
Identity, resulting in each call to the method causing the email and password provided during the authentication attempt to be sent to the attackers' host. This allows interception of user login parameters for services using the Identity class that have installed a vulnerable version of the rest-client library, which is listed as a dependency in many popular Ruby packages, including ast (64 million downloads), oauth (32 million), fastlane (18 million), and kubeclient (3.7 million).

Additionally, a backdoor was added to the code allowing arbitrary Ruby code to be executed via the eval function. The code is transmitted via a cookie signed with the attacker's key. To inform the attackers about the installation of the malicious package on an external host, the URL of the victim's system and a set of environment details, such as saved database and cloud service passwords, are sent. Attempts to upload cryptocurrency mining scripts have been recorded using the aforementioned malicious code.

After examining the malicious code, it was found that similar changes are also present in seven vulnerabilities have been identified10 packages in Ruby Gems, which were not captured but were specifically prepared by the attackers based on other popular libraries with similar names, where the hyphen was replaced with an underscore or vice versa (for example, based on cron-parser , a malicious package named cron_parser was created, and based on doge_coin , a malicious package named doge-coin was created). Problematic packages include: coin_base

• blockchain_wallet: 4.2.2, 4.2.1
• awesome-bot: 0.0.6, 0.0.7
• doge-coin: 1.18.0
• capistrano-colors: 1.0.2
• bitcoin_vanity: 0.5.5
• lita_coin: 4.3.3
• coming-soon: 0.0.3
• omniauth_amazon: 0.2.8
• cron_parser: 1.0.1
• The first malicious package from this list was posted on May 12, but most appeared in July. In total, the listed packages were downloaded about 2500 times.: 1.0.12, 1.0.13, 0.1.4

The first malicious package from this list was uploaded on May 12, but most appeared in July. In total, the specified packages have been downloaded about 2500 times.

Source: opennet.ru