PT-2021-15665 · Microsoft+2 · Nuget+3

Alex Birsan · Published 2021-02-25 · Updated 2023-12-29 · CVE-2021-24105

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Bundler versions 1.16.0 through 2.2.9 Bundler versions 2.2.11 through 2.2.17 Python/pip (affected versions not specified) .NET/NuGet (affected versions not specified) Java/Maven (affected versions not specified) JavaScript/npm (affected versions not specified)

Description: The issue allows an attacker to insert a malicious package into a package manager's repository, which can lead to remote code execution. This can affect multiple package managers across different languages. An attacker can create a malicious package with a high version number and publish it to a public repository, causing vulnerable machines to download and install it. The attack can occur at various levels, including developer machines, teams, continuous integration pipelines, and customers. The estimated number of potentially affected devices worldwide is not specified.

Recommendations: For Bundler versions 1.16.0 through 2.2.9 and 2.2.11 through 2.2.17, reconfigure the installation tools and workflows to prioritize private gems over public ones. For Python/pip, reconfigure the package manager to avoid dependency confusion. For .NET/NuGet, reconfigure the package manager to avoid dependency confusion. For Java/Maven, reconfigure the package manager to avoid dependency confusion. For JavaScript/npm, reconfigure the package manager to avoid dependency confusion. As a temporary workaround, consider restricting access to public package repositories until a proper configuration is in place. Avoid using packages with high version numbers from untrusted sources.

Exploit

Fix

Related Identifiers

CVE-2021-24105

GHSA-FP4W-JXHP-M23P

Affected Products

.Net Framework

Maven

Nuget

Pip

References · 16

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bundler/CVE-2020-36327.yml · Exploit
• https://osv.dev/vulnerability/GHSA-fp4w-jxhp-m23p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36327 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-24105 · Vendor Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24105 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/MWXHK5UUHVSHF7HTHMX6JY3WXDVNIHSL · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24105 · Security Note
• https://github.com/rubygems/rubygems/issues/3982 · Note
• https://github.com/rubygems/rubygems · Note
• https://github.com/rubygems/rubygems/pull/4609 · Note
• https://github.com/rubygems/rubygems/blob/master/bundler/CHANGELOG.md#2218-may-25-2021 · Note
• https://github.com/rubygems/rubygems/commit/078bf682ac40017b309b5fc69f283ff640e7c129 · Note
• https://bundler.io/blog/2021/02/15/a-more-secure-bundler-we-fixed-our-source-priorities.html · Note
• https://zofrex.com/blog/2021/04/29/bundler-still-vulnerable-dependency-confusion-cve-2020-36327 · Note
• https://mensfeld.pl/2021/02/rubygems-dependency-confusion-attack-side-of-things · Note