Yeeks. Not good.
(sudo) gem update --system ASAP
AFAICS this is the relevant line: https://github.com/rubygems/rubygems/blob/master/lib/rubygem...
Edit: Or, if you want to get a little more creative, have your gem include a plugin to rubygems itself, similar to what https://github.com/rvm/executable-hooks does.
So while this is bad, I don't think it's that bad -- a malicious gem could always mess you up. Still update!
But even if: most systems today probably only run that one service, and the application server can rwx pretty much everything of interest because that's its job, right?
10 years or so ago you'd often see some company's server running apache as well as a mail server, the internal document repository and the financial systems. In that sort of setup, it's important to (try to) keep these systems isolated from each other. But today, all that root access would give you is the ability to read a few more Ubuntu man pages.
Eh, I don't know about that. I don't think most application servers are running as root, and I'm pretty sure it's considered bad practice to run them as root, no?
But yeah, they still need to have enough privs to do their jobs, which will be a lot of privs. But you still don't go from that to "might as well just run as root then".
The file overwrite and the ANSI sequence vulnerabilities are extra attack vectors. The main one has anyways been the code itself and its vetting process. This for Ruby gems and for any other open and closed source piece of code we run on our machines, starting from the processor(s) microcode.
After this got uncovered, Duo published a blog post where they scanned for and found several others malicious packages:
https://duo.com/blog/hunting-malicious-npm-packages
The last one they talk about worms itself by adding itself to any packages authored on the computer it's installed on.
These issues are not unique to npm.
Granted that was just data collection, but the outcome could be incredibly worse if a combo of popular but bad code and a little bit of money.
The problem here is that you don't even have to get directly attacked to be affected.
People in such responsible positions are on respective announcement mailing lists anyway, and read about those events (and patch their system and/or take other measures) long before the story is upvoted on HN.
For example, every administrator of Debian systems is expected to be subscribed to the "debian-security-announce" mailing list.
Also, everyone who is interested or active in German net politics is subscribed to the "netzpolitik.org" RSS feed, or visits that site regularily.
Waiting until such a story hits HN and reyling on that seems highly dubious to be. As soon as any important story hits social media (such as Twitter, Reddit or HN), all important measures have already been finished. HN is really the end stage here, not the beginning. It is the reaction, not the initiative.
In short: Use the real network and connect directly to the relevant groups. Don't rely on aggregation networks.
(BTW, isn't is almost comical that the latter, rather than the former, are called "social" networks?)
Don't overestimate people; most devs and managers would look the other way if not much internet attention is given to their security issue. If they notice a report on HN they kind of panic and go in damage control mode, and then maybe actually fix the issue itself as well.
Being vocal on a popular and respected forum as HN is important for important issues to get much-needed attention.
Please note: I don't like that this is the truth but alas, I guess this is how Homo Sapiens works: it's not important if you know you screwed up; you can bullsh*t yourself to oblivion and delude your conscience but once many people know about your screw-up, then you suddenly care.
There's been tons of suggestions about site improvements (much smaller ones, mind you) that have never gained any attention.
https://github.com/rubygems/rubygems/commit/8d91516fb7037ecf... https://github.com/rubygems/rubygems/commit/8a38a4fc24c6591e... https://github.com/rubygems/rubygems/commit/44cc27cd6123b8ea... https://github.com/rubygems/rubygems/commit/ad5c0a53a86ca5b2...
https://github.com/rubygems/rubygems/commit/ef0aa611effb5f54...
I went through all 4 issues and did a brief writeup for each of them. Only the first 2 issues are serious (and worth upgrading for). The last 2 issues are not really a big deal at all.
1) "a DNS request hijacking vulnerability"
Rubygems supports a gem server discovery mechanism, where if you set your gem source as 'https://example.com', the gem client will do a SRV dns lookup on "_rubygems._tcp.example.com" to determine where it should send requests to.
A MITM can intercept that dns request and return whatever server they want, forcing the gem client to download code from a malicious server.
Fixed by:
https://github.com/rubygems/rubygems/commit/8d91516fb7037ecf...
Now the returned DNS record must be for a subdomain of the gem source (in this case it must point to a subdomain of "example.com").
2) "a vulnerability in the gem installer that allowed a malicious gem to overwrite arbitrary files"
Gem contents could be unpacked in arbitrary file locations by setting the gem name to include file traversal characters like "../".
Fixed by:
https://github.com/rubygems/rubygems/commit/44cc27cd6123b8ea...
https://github.com/rubygems/rubygems/commit/ad5c0a53a86ca5b2...
Now gem names can only contain letters, numbers, underscore (_), dash (-), and dot (.).
3) "an ANSI escape sequence vulnerability"
Text specified in a gemspec can be output on installation or displayed when showing information about the gem. Gem authors can inject terminal escape sequences into (for instance) the authors field of the gem, and this will mess with end users' terminals.
Fixed by:
https://github.com/rubygems/rubygems/commit/ef0aa611effb5f54...
Now ANSI control characters are scrubbed out of text fields.
4) "a DoS vulernerability in the query command"
If someone provided an extremely large gem summary, rubygems would hang trying to process it.
Fixed by:
https://github.com/rubygems/rubygems/commit/8a38a4fc24c6591e...
Now the summary is truncated to 100,000 characters. I'm a little surprised this was even triaged as a vulnerability.
