PT-2019-13286 · Ruby · Strong Password

Tute Costa · Published 2019-07-08 · Updated 2019-07-10 · CVE-2019-13354

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions strong password gem version 0.0.7

Description A code-execution backdoor was inserted into the strong password gem by a third party. This backdoor allows the execution of external code controlled by an unknown attacker, which is hosted on the Pastebin service. The strong password gem has been downloaded approximately 247,000 times, with version 0.6 being downloaded around 38,000 times. The malicious version 0.0.7 has been downloaded 537 times, although the accuracy of this number is uncertain since the release has been removed from Ruby Gems.

Recommendations For version 0.0.7, update to version 0.0.8 or earlier version 0.0.6 to remove the code-execution backdoor. As a temporary workaround, consider avoiding the use of the strong password gem until a secure version is installed.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2019-13354

GHSA-5H5R-FFC4-C455

Affected Products

Strong Password

References · 12

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/strong_password/CVE-2019-13354.yml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-13354 · Security Note
• https://osv.dev/vulnerability/CVE-2019-13354 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5h5r-ffc4-c455 · Vendor Advisory
• https://github.com/bdmac/strong_password/releases · Note
• https://github.com/bdmac/strong_password · Note
• https://rubygems.org/gems/strong_password/versions · Note
• https://t.me/tmfeed/66007 · Telegram Post
• https://benjamin-bouchet.com/blog/vulnerabilite-dans-la-gem-strong_password-0-0-7 · Note
• https://withatwist.dev/strong-password-rubygem-hijacked.html · Note
• https://t.me/opennews/5364 · Telegram Post
• https://t.me/cvenotify/304 · Telegram Post