PT-2023-27300 · Unknown · Rubygems.Org
Segiddins
·
Published
2023-08-17
·
Updated
2023-08-24
·
CVE-2023-40165
CVSS v3.1
7.4
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
rubygems.org (affected versions not specified)
Description
The issue is related to insufficient input validation in rubygems.org, the Ruby community's primary gem hosting service. This allowed malicious actors to replace any uploaded gem version that had a platform, version number, or gem name matching
/-d/, permanently replacing the legitimate upload in the canonical gem storage bucket and triggering an immediate CDN purge. The maintainers have checked all gems matching the /-d/ pattern and can confirm that no unexpected .gems were found, leading to the belief that this issue was not exploited. Users can verify the integrity of their downloaded gems by checking that the checksums match the ones recorded in the RubyGems.org database.Recommendations
No action is required on the part of the user, as the issue has been patched with improved input validation and the changes are live. However, users are advised to validate their local gems. To assist in the investigation, users can run
bundle add bundler-integrity followed by bundle exec bundler-integrity to compare RubyGems API-provided checksums with the checksums of files on their disk.Exploit
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Rubygems.Org