PT-2019-14021 · Ruby · Rest-Client

Juskoljo · Published 2019-08-19 · Updated 2021-02-23 · CVE-2019-15224

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions rest-client versions 1.6.10 through 1.6.13 lita-coin version 0.0.3

Description The rest-client gem for Ruby included a code-execution backdoor inserted by a third party, which allowed the execution of malicious commands and sent information to an external host. This backdoor was inserted through the compromise of the developer's account in the rubygems.org repository. Approximately 1,000 users downloaded the affected versions before they were blocked. The rest-client gem has been downloaded 113 million times in total. Additionally, lita-coin contains a backdoor mechanism that allows launching hidden cryptocurrency mining operations and executing malicious commands.

Recommendations For rest-client versions 1.6.10 through 1.6.13, consider downgrading to version 1.6.9 or upgrading to version 1.7.x. For lita-coin version 0.0.3, there is no information about a newer version that contains a fix for this issue. As a temporary workaround, consider disabling the backdoor mechanism until a patch is available. Restrict access to the affected gem to minimize the risk of exploitation. Avoid using the affected gem in production environments until the issue is resolved.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2019-15224

GHSA-333G-RPR4-7HXQ

GHSA-Q2HM-GX3F-H63Q

Affected Products

Rest-Client

References · 20

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/doge-coin/CVE-2019-15224.yml · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/omniauth_amazon/CVE-2019-15224.yml · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rest-client/CVE-2019-15224.yml · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/coin_base/CVE-2019-15224.yml · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lita_coin/CVE-2019-15224.yml · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/blockchain_wallet/CVE-2019-15224.yml · Exploit
• 🔥 https://github.com/chef-cft/inspec_cve_2019_15224 · Exploit
• https://osv.dev/vulnerability/CVE-2019-15224 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q2hm-gx3f-h63q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15224 · Security Note
• https://osv.dev/vulnerability/GHSA-333g-rpr4-7hxq · Vendor Advisory
• https://github.com/rest-client/rest-client · Note
• https://github.com/rest-client/rest-client/issues/713 · Note
• https://github.com/rubygems/rubygems.org/issues/2097 · Note
• https://github.com/rubygems/rubygems.org/wiki/Gems-yanked-and-accounts-locked#19-aug-2019 · Note