CVE-2018-3779: Active support Active-support Impersonates 'activesupport' Gem Vulnerability

CRITICAL
Advisory Identifier: GHSA-2j55-pcw5-x4h2
Share
CWE-77
Published
Advisory Summary

CVE-2018-3779 is a CRITICAL active-support impersonates 'activesupport' gem vulnerability (CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')) affecting Active support libraries in the RubyGems ecosystem. The issue involves active-support impersonates 'activesupport' gem. Remediation is available in the latest vendor maintenance releases.

CVE-2018-3779 at a Glance

CVE Identifier CVE-2018-3779
GHSA Identifier GHSA-2j55-pcw5-x4h2
Severity CRITICAL
CVSS v3.1 Base Score N/A
CWE Classification CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected Product Active support
Package Ecosystem RubyGems
Published Date
Last Updated

How to Fix CVE-2018-3779

To remediate this vulnerability, upgrade all affected Active support dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

active-support fixed: Latest secure release 
Upgrade active-support to Latest secure release
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for active-support

How to Check if You Are Affected

To determine whether your application is affected by CVE-2018-3779, inspect your project dependencies for Active support:

inspect dependencies for active-support

Analyze the terminal output to locate any version of Active support in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection'), where the product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. In Active support, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

The `active-support` ruby gem gem is malware and duplicates the official `activesupport` (no hyphen) gem, but adds a compiled extension. The extension attempts to resolve a base64 encoded domain (29faea63.planfhntage.de), downloads a payload, and executes. This trojan horse gem could allow a remote attacker to execute arbitrary code on the system, caused by containing a malicious backdoor. An attacker could exploit this vulnerability to execute arbitrary code on the system. No version of this gem should be considered safe.

CVE-2018-3779 Affected Active support Versions

1 component(s)
Product / Package Ecosystem Affected Versions Fixed Version
active-support
gem/active-support
RubyGems

References

NVD — CVE-2018-3779 NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-3779
hackerone.com/reports/392311 WEB
https://hackerone.com/reports/392311
GitHub Advisory / Wiki ADVISORY
https://github.com/advisories/GHSA-2j55-pcw5-x4h2

Frequently Asked Questions

What is CVE-2018-3779?
CVE-2018-3779 is a security vulnerability in Active support involving active-support impersonates 'activesupport' gem under CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection').
Which Active support versions are affected?
Affected versions include releases prior to current release patches across affected packages: active-support.
What version fixes CVE-2018-3779?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
Is active-support affected?
Yes, active-support is affected in releases prior to Latest secure release. Upgrade your dependency to Latest secure release or later.
What CWE is associated with CVE-2018-3779?
CVE-2018-3779 is classified under CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') (The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.).
How can I check RubyGems dependencies for CVE-2018-3779?
Run the dependency tree command: 'inspect dependencies for active-support'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-2j55-pcw5-x4h2",
  "modified" : "2023-01-18T21:33:05Z",
  "published" : "2018-08-13T15:02:49Z",
  "aliases" : [ "CVE-2018-3779" ],
  "summary" : "active-support impersonates 'activesupport' gem",
  "details" : "The `active-support` ruby gem gem is malware and duplicates the official `activesupport` (no hyphen) gem, but adds a compiled extension. The extension attempts to resolve a base64 encoded domain (29faea63.planfhntage.de), downloads a payload, and executes.\n \nThis trojan horse gem could allow a remote attacker to execute arbitrary code on the system, caused by containing a malicious backdoor. An attacker could exploit this vulnerability to execute arbitrary code on the system.  No version of this gem should be considered safe.",
  "severity" : [ ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "RubyGems",
      "name" : "active-support"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2018-3779"
  }, {
    "type" : "WEB",
    "url" : "https://hackerone.com/reports/392311"
  }, {
    "type" : "ADVISORY",
    "url" : "https://github.com/advisories/GHSA-2j55-pcw5-x4h2"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-77" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2020-06-16T20:52:19Z",
    "nvd_published_at" : null
  }
}