rubygems.org: Improper Authentication
CVE-2022-36073 is a high-severity improper authentication vulnerability in rubygems.org from Rubygems, with a CVSS 3.1 base score of 8.8 out of 10. It can be exploited remotely over the network by an attacker with a low-privileged account, without any action from a user. Affected rubygems.org versions: < 90c9e6aac2d91518b479c51d48275c57de492d4d. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 1.04% chance of exploitation within 30 days, higher than 65% of scored CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Rubygems to 2022-08-31 or a later version.
- Read the advisory on github.com for workarounds and exact fixed builds.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Rubygems | rubygems.org | < 90c9e6aac2d91518b479c51d48275c57de492d4d | Not stated |
| Rubygems | Rubygems | before 2022-08-31 | 2022-08-31 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 8.3 | High | CNA (github.com) |
| CVSS 3.1 | 8.8 | High | NVD |
Official description
RubyGems.org is the Ruby community gem host. A bug in password & email change confirmation code allowed an attacker to change their RubyGems.org account's email to an unowned email address. Having access to an account whose email has been changed could enable an attacker to save API keys for that account, and when a legitimate user attempts to create an account with their email (and has to reset password to gain access) and is granted access to other gems, the attacker would then be able to publish and yank versions of those gems. Commit number 90c9e6aac2d91518b479c51d48275c57de492d4d contains a patch for this issue.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
How developers prevent this class of flaw
- Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Advisories
- github.com/rubygems/rubygems.org/security/advisories/GHSA-8qpf-wf2p-25vgThird Party Advisory
Patches and release notes
- github.com/rubygems/rubygems.org/commit/90c9e6aac2d91518b479c51d48275c57de492d4dThird Party Advisory
Other vulnerabilities in rubygems.org
- 9.8 Critical severity
- 7.5 High severity
- 7.5 High severity
- 7.5 High severity
Recent Improper Authentication vulnerabilities
- 7.8 High severity
- 8.2 High severity
- 9.8 Critical severity
- 9.1 Critical severity
- 8.8 High severity
- 9.8 Critical severity
Spotted an error? Tell us.