CVE-2018-3779

Vulnerability

The active-support gem (version 5.2.0) is a malicious package that impersonates the legitimate activesupport gem. It contains a compiled extension that resolves a base64-encoded domain (29faea63.planfhntage.de), downloads a payload, and executes it. No version of this gem should be considered safe [1][2].

Exploitation

An attacker can exploit this by tricking a user into installing the active-support gem instead of the legitimate activesupport gem. This could occur via typosquatting or dependency confusion. Once installed, the gem's extension automatically contacts the remote domain, downloads a payload, and executes it without further user interaction [2].

Impact

Successful exploitation allows a remote attacker to execute arbitrary code on the system with the privileges of the Ruby process. This can lead to full compromise of the affected system, including data theft, installation of malware, or further lateral movement [1][2].

Mitigation

There is no patched version because the gem is inherently malicious. Users should ensure they install the legitimate activesupport gem (no hyphen) from trusted sources. Organizations should audit their Gemfile.lock for any occurrence of active-support and remove it immediately. The gem is not listed in the official RubyGems repository as of the advisory date [2].