Cross Site Scripting (XSS) Vulnerability in RubyGems and JRuby Packages
Summary
CVE-2018-1000078: RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripti... Affects jruby across 2 version ranges.
< 9.1.17.0-1
< 66a28b9275551384fdab45f3591a82d6b59952cb
Fixed in 9.1.17.0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
RubyGems is a package manager for the Ruby programming language, facilitating the distribution and management of Ruby libraries (gems). JRuby is an implementation of Ruby on the Java Virtual Machine (JVM). Both packages are widely used in Ruby development, but they have been found to be vulnerable to a Cross Site Scripting (XSS) attack that can compromise user security when interacting with malicious gems.
Vulnerability Detail
The vulnerability identified as CVE-2018-1000078 affects multiple versions of RubyGems and JRuby, specifically those prior to certain fixed versions. The flaw lies in the gem server's display of the homepage attribute, which can be manipulated to execute malicious scripts in the user's browser. This XSS vulnerability can be exploited when a user visits a malicious gem on a vulnerable server, potentially leading to data theft or unauthorized actions performed on behalf of the user.
How To Fix
Minimum fixed version
9.1.17.0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jrubyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, users can mitigate the risk by avoiding interaction with untrusted gems and ensuring that they only browse reputable gem servers. Additionally, implementing Content Security Policy (CSP) headers can help reduce the risk of XSS attacks.
Conclusion
The CVE-2018-1000078 vulnerability poses a significant risk to users of RubyGems and JRuby due to its potential for XSS attacks. It is crucial for developers to upgrade to the latest versions of these packages to mitigate the risk and ensure the security of their applications.
See every vulnerability recorded for jruby →
FAQ
CVE-2018-1000078 is a vulnerability affecting RubyGems and JRuby that allows for Cross Site Scripting (XSS) attacks through the manipulation of gem server homepage attributes.
You can use tools like Vulert, which monitors open-source vulnerabilities in your software using a manifest file. You can check your application against this vulnerability without any signup at the Vulert playground.
Exploiting this vulnerability can lead to unauthorized actions being performed in the context of the user’s session, potentially resulting in data theft or other malicious activities.
Affected versions include RubyGems versions 2.2.9 and earlier, 2.3.6 and earlier, 2.4.3 and earlier, and 2.5.0 and earlier, as well as corresponding JRuby versions.
The best way to secure your application is to upgrade to the fixed versions of RubyGems and JRuby. Additionally, avoid using untrusted gems and implement security headers like CSP.
Related vulnerabilities
Recent vulnerabilities recorded for jruby.
