Foi encontrado código malicioso no rest-client e em outros 10 pacotes Ruby

No popular gem package rest-client, totaling 113 million downloads, foi identificada malicious code injection (CVE-2019-15224) that loads executable commands and sends information to an external host. The attack was carried out through compromise of the developer's account rest-client in the rubygems.org repository, after which attackers published releases 1.6.10-1.6.13 on August 13 and 14, including malicious changes. Before the harmful versions were blocked, about a thousand users managed to download them (the attackers, to avoid attracting attention, released updates for older versions).

The malicious change overrides the method “#authenticate” in the class
Identity, after which each method call sends the email and password provided during the authentication attempt to the attacker's host. This allows interception of the login parameters of users of services using the Identity class and having installed a vulnerable version of the rest-client library, which is featured as a dependency in many popular Ruby packages, including ast (64 million downloads), oauth (32 million), fastlane (18 million), and kubeclient (3.7 million).

In addition, a backdoor was added to the code, allowing arbitrary Ruby code to be executed via the eval function. The code is sent through a Cookie, signed with the attacker's key. To inform the attackers about the installation of the malicious package on the external host, the victim's system URL and a collection of environment information, such as saved passwords for databases and cloud services, are sent. Attempts to upload scripts for cryptocurrency mining have been recorded using the aforementioned malicious code.

After examining the malicious code, it was identificado, that similar changes are present in 10 packages in Ruby Gems, which were not captured, but specifically prepared by attackers based on other popular libraries with similar names, in which a dash was replaced with an underscore or vice versa (for example, based on cron-parser a malicious package cron_parser was created, and based on doge_coin the malicious package doge-coin). Problematic packages:

• coin_base: 4.2.2, 4.2.1
• blockchain_wallet: 0.0.6, 0.0.7
• awesome-bot: 1.18.0
• doge-coin: 1.0.2
• capistrano-colors: 0.5.5
• bitcoin_vanity: 4.3.3
• lita_coin: 0.0.3
• coming-soon: 0.2.8
• omniauth_amazon: 1.0.1
• cron_parser: 1.0.12, 1.0.13, 0.1.4

The first malicious package from this list was posted on May 12, but most appeared in July. In total, the specified packages have been downloaded about 2500 times.

Fonte: opennet.ru