{"id":103981,"date":"2022-05-09T09:36:45","date_gmt":"2022-05-09T07:36:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-rubygems-org-pozvolyayushhaya-podmenit-chuzhie-pakety"},"modified":"2022-05-09T09:36:45","modified_gmt":"2022-05-09T07:36:45","slug":"uyazvimost-v-rubygems-org-pozvolyayushhaya-podmenit-chuzhie-pakety","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-rubygems-org-pozvolyayushhaya-podmenit-chuzhie-pakety","title":{"rendered":"Vulnerability in RubyGems.org allows substitution of foreign packages","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A critical vulnerability (CVE-2022-29176) has been identified in the RubyGems.org package repository, allowing unauthorized users to replace certain foreign packages in the repository by initiating the yank of a legitimate package and uploading another file with the same name and version number in its place. <\/p>\n
Three conditions must be met for successful exploitation of the vulnerability: <\/p>\n
\n
The attack can only be carried out on packages that contain a hyphen in their name.\n
An attacker should be able to upload a gem package with part of the name before the hyphen. For example, if the attack is aimed at the package «rails-html-sanitizer», the attacker should upload their own package «rails-html» to the repository.\n
The target package must have been created in the last 30 days or not updated for 100 days. <\/ul>\n
The vulnerability is caused by an error in the «yank» action handler, which treats the part of the name after the hyphen as the platform name, allowing the deletion of foreign packages that match the part of the name before the hyphen. Specifically, in the code of the «yank» operation handler, a call to ‘find_by!(full_name: «#{rubygem.name}-#{slug}»)’ was used to search for packages, where the «slug» parameter was provided by the package owner to specify the version to be deleted. The owner of the «rails-html» package could specify «sanitizer-1.2.3» instead of version «1.2.3», which would cause the operation to affect the foreign package «rails-html-sanitizer-1.2.3». <\/p>\n
The issue was discovered by a security researcher as part of an ongoing HackerOne bug bounty program for identifying security issues in well-known open projects. The issue was resolved in RubyGems.org on May 5, and according to the developers, they have not yet detected any signs of exploitation of the vulnerability in the logs for the past 18 months. However, only a superficial audit has been performed so far, and a more in-depth inspection is planned for the future. <\/p>\n
To check their projects, it is advisable to analyze the operation history in the Gemfile.lock file; malicious activity can be indicated by changes that preserve the name and version or change the platform (for example, when the gemname-1.2.3 package is updated to gemname-1.2.3-java). As a workaround to protect against hidden package substitution in continuous integration systems or when publishing projects, developers are recommended to use Bundler with the «—frozen» or «—deployment» options to lock dependencies. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"