PT-2019-12046 · Twitter · Bootstrap-Sass

Derek Barnes · Published 2019-04-04 · Updated 2019-04-11 · CVE-2019-10842

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions bootstrap-sass version 3.2.0.3

Description Arbitrary code execution was discovered in bootstrap-sass, allowing an unauthenticated attacker to craft the cfduid cookie value with base64 arbitrary code to be executed via eval(), which can be leveraged to execute arbitrary code on the target system. The issue is unrelated to the cfduid cookie used by Cloudflare. The vulnerable version has been downloaded around 28 million times.

Recommendations For version 3.2.0.3, update to version 3.2.0.4 to resolve the issue. As a temporary workaround, consider restricting access to the eval() function or disabling the execution of arbitrary code via the cfduid cookie until the update is applied.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2019-10842

GHSA-VQQV-V9M2-48P2

SNYK-RUBY-BOOTSTRAPSASS-174093

Affected Products

Bootstrap-Sass

References · 10

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bootstrap-sass/CVE-2019-10842.yml · Exploit
• 🔥 https://snyk.io/blog/malicious-remote-code-execution-backdoor-discovered-in-the-popular-bootstrap-sass-ruby-gem · Exploit
• 🔥 https://snyk.io/vuln/SNYK-RUBY-BOOTSTRAPSASS-174093 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-10842 · Security Note
• https://osv.dev/vulnerability/GHSA-vqqv-v9m2-48p2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10842 · Vendor Advisory
• https://github.com/twbs/bootstrap-sass · Note
• https://github.com/twbs/bootstrap-sass/issues/1195 · Note
• http://dgb.github.io/2019/04/05/bootstrap-sass-backdoor.html · Note
• https://t.me/opennews/4939 · Telegram Post