ASA-2019-00357 – RubyGems: Delete directory using symlink when decompressing tar

Posted on by Allele Security Intelligence in Alerts

Allele Security Alert

ASA-2019-00357

Identifier(s)

ASA-2019-00357, CVE-2019-8320

Title

Delete directory using symlink when decompressing tar

Vendor(s)

RubyGems.org

Product(s)

RubyGems

Affected version(s)

RubyGems 2.7.6 and later through 3.0.2

Fixed version(s)

RubyGems 3.0.3
RubyGems 2.7.8

Proof of concept

Unknown

Description

A directory traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new directories or touching files (which now include path-checking code for symlinks), it would delete the target destination. If that destination was hidden behind a symlink, a malicious gem could delete arbitrary files on the user’s machine, presuming the attacker could guess at paths. Given how frequently gem is run as sudo, and how predictable paths are on modern systems (/tmp,/usr, etc.), this could likely lead to data loss or an unusable system.

Technical details

Unknown

Credits

ooooooo_q

Reference(s)

March 2019 Security Advisories
https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html

Validate that symlinks cannot cause dirs outside of the gem to be deleted
https://github.com/rubygems/rubygems/commit/e2b5c58de49b83381d7971f5bb1d901721ed5818

ruby-2.4.5-rubygems-v2.patch
https://bugs.ruby-lang.org/attachments/7669

CVE-2019-8320
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8320

CVE-2019-8320
https://nvd.nist.gov/vuln/detail/CVE-2019-8320

If there is any error in this alert or you wish a comprehensive analysis, let us know.

Last modified: June 19, 2019

We are not responsible for any data loss, device corruption or any other type of issue due to the use of any information mentioned in our security alerts.