Backdoor (CVE-2019-10842) was detected in the popular Ruby-library bootstrap-sass (Bootstrap 3 option with Sass support), which has about 28 million downloads, allowing attackers to execute their code on servers running projects using bootstrap-sass . The backdoor has been added to release 22.214.171.124, published March 26 in the RubyGems repository. The issue is resolved in release 126.96.36.199, proposed on April 3rd.
The backdoor was hiddenly added to the
lib/active-controller/middleware.rb, in which the code for calling
eval appeared with the value passed through the
"___ cfduid =". For an attack, it was enough to send a request to the server, setting the
cookie "___cfduid" and pass as an argument the commands encoded in Base64 format. The name of the
cookie "___cfduid" was chosen for camouflage under the
cookie "__cfduid", set by CDN Cloudflare and characterized by the presence of two underscores instead of three.
It is noteworthy that the malicious code was published only in the final package published in the RubyGems repository, but was not included in the source code in the Git repository. The source code of the library remained correct and did not arouse suspicion among developers, which underscores the importance of using repeatable builds and implementing a process to verify the compliance of published packages with reference sources. Apparently, the attack was carried out through the seizure of the account parameters to RubyGems from one of the two library maintainers (officially the leakage of account data has not yet been confirmed).
The attackers showed prudence and built the backdoor not into the latest 3.4.x branch, the latest release of which has more than 217,000 downloads, but as an update for the previous 3.2.x branch, relying on the fact that corrective update of dependency will not cause suspicion. A rough estimate of the 1670 repositories on GitHub use bootstrap-sass as a dependency and applications associated with these repositories can potentially be compromised. Developers are advised to trace the use of the bootstrap-sass library among indirect dependencies and check whether the automatic upgrade to the backdoor version has been performed. Judging by the statistics of the RubyGems package, the backdoor package was downloaded about 1,500 times.
Information about a possible backdoor was published in the bug tracking system a few hours after placing the problematic release 188.8.131.52, after which the maintainers removed the problematic release from RubyGems about an hour later and changed their login passwords, but did not take into account that the removed versions could remain for several days on the mirrors. On April 3, an additional release 184.108.40.206 was created, completely analogous to version 220.127.116.11, which made it possible to get rid of the version with backdoor without switching to a new branch 3.4.