{"id":37310,"date":"2019-10-31T22:16:54","date_gmt":"2019-10-31T19:16:54","guid":{"rendered":"https:\/\/prohoster.info\/blog\/v-rest-client-i-eshhyo-10-ruby-paketah-vyyavlen-vredonosnyj-kod\/"},"modified":"2019-10-31T22:16:54","modified_gmt":"2019-10-31T19:16:54","slug":"v-rest-client-i-eshhyo-10-ruby-paketah-vyyavlen-vredonosnyj-kod","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/v-rest-client-i-eshhyo-10-ruby-paketah-vyyavlen-vredonosnyj-kod","title":{"rendered":"Malicious code detected in rest-client and 10 other Ruby packages","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

In the popular gem package rest-client<\/a><\/noindex>, which has a total of 113 million downloads, identified<\/a><\/noindex> malicious code injection (CVE-2019-15224), which downloads executable commands and sends information to an external host. The attack occurred through compromise<\/a><\/noindex> of the developer account of rest-client in the rubygems.org repository, after which attackers published versions 1.6.10-1.6.13 on August 13 and 14, with malicious changes included. About a thousand users managed to download the malicious versions before they were blocked (the attackers released updates for older versions to avoid drawing attention).<\/p>\n

Malicious modification overrides the method «#authenticate» in the class
\nIdentity, resulting in each call to the method causing the email and password provided during the authentication attempt to be sent to the attackers' host. This allows interception of user login parameters for services using the Identity class that have installed a vulnerable version of the rest-client library, which is listed<\/a><\/noindex> as a dependency in many popular Ruby packages, including ast (64 million downloads), oauth (32 million), fastlane (18 million), and kubeclient (3.7 million).<\/p>\n

Additionally, a backdoor was added to the code allowing arbitrary Ruby code to be executed via the eval function. The code is transmitted via a cookie signed with the attacker's key. To inform the attackers about the installation of the malicious package on an external host, the URL of the victim's system and a set of environment details, such as saved database and cloud service passwords, are sent. Attempts to upload cryptocurrency mining scripts have been recorded using the aforementioned malicious code.<\/p>\n

After examining the malicious code, it was found that similar changes are also present in seven vulnerabilities have been identified<\/a><\/noindex>10 packages in Ruby Gems, which were not captured but were specifically prepared by the attackers based on other popular libraries with similar names, where the hyphen was replaced with an underscore or vice versa (for example, based on<\/a><\/noindex> cron-parser , a malicious package named cron_parser was created, and based on<\/a><\/noindex> doge_coin , a malicious package named doge-coin was created). Problematic packages include:<\/a><\/noindex> coin_base<\/p>\n