RubyGems

About

RubyGems.org is the public registry for Ruby libraries, called gems, and Bundler installs the set an app needs. Rails apps pull in dozens of gems, and GitLab hundreds. A gem with native code runs a build step on the machine that installs it.

Gems with native extensions run build code when they install, with the rights of whoever installs them. Everything else runs inside the app when it loads, at every start.

If It Is Malicious

If a gem is malicious, it runs inside a Ruby app with the app's rights, on every developer laptop and build server that installs it.

Its code runs inside these technologies.

GitLabRuby on RailsPumaRuby

See It in the Stack

Examples

These are well-known names from RubyGems, written as you would meet them in an inventory, an alert or a lockfile, the file that records every version a build installed.

rails

Ruby on Rails, installed as a set of gems.

rack

The interface between Ruby web servers and apps.

nokogiri

Parses HTML and XML, with native code inside.

devise

Sign-in and accounts for Rails apps.

rest-client

A simple HTTP client. It was hijacked in 2019.

How Bad Code Gets In

These are the ways bad code can reach your systems through RubyGems. None of them needs a flaw in your own code, so outside code needs checking as much as your own.

• A maintainer's account is taken over and a bad version is pushed.
• A gem named like a popular one catches mistyped installs.
• A gem with native code runs commands on the machine as it installs.

How to Check

These checks show what came from RubyGems, whether a known bad version is in use, and how to keep one out next time.

• Commit Gemfile.lock and install from it in every build.
• Run bundler-audit, which checks Gemfile.lock against the Ruby advisory database.
• Prefer gems whose owners use multi-factor sign-in, which RubyGems.org requires for its most downloaded gems.
• Point Bundler at one source, or a mirror, rather than mixing sources.

Well-Known Incidents

Each incident below is a real case, told at the level of its public advisory. The tag says how the bad code got in, and the link opens the primary source.

• Hijacked AccountCVE-2019-152242019

  rest-client Gem Hijack

  Bad versions of the rest-client gem, pushed from a hijacked maintainer account, sent the host's environment to the attacker and could fetch and run more code.

  Reach The code only woke in Rails apps running in production, which leaked their environment variables, often holding cloud and database credentials.

  Affectedrest-client

  Source: github.com (opens in a new tab)

In Common Stacks

These common stacks take code from RubyGems. Open one to see where that code sits among its layers and who runs each one.

• A Rails App on Puma

Sources

• RubyGems Guides: security (opens in a new tab)
• bundler-audit (opens in a new tab)
• Ruby Advisory Database (opens in a new tab)