CVE-2019-10842

Vulnerability

Arbitrary code execution was discovered in the bootstrap-sass Ruby gem version 3.2.0.3, when downloaded from RubyGems.org [2]. The malicious package includes a backdoor that reads a cookie named ___cfduid (three underscores) and passes its base64-decoded value to eval(), enabling arbitrary code execution on the server [2][3]. This version was published only to RubyGems; no source code changes exist in the official GitHub repository [3].

Exploitation

An unauthenticated attacker can exploit this vulnerability by sending an HTTP request to a Rails application using the vulnerable gem, with a crafted ___cfduid cookie containing base64-encoded arbitrary code [2][3]. No authentication or prior access is required. The server-side code decodes the cookie and executes it via eval(), allowing immediate code execution [3].

Impact

Successful exploitation gives the attacker full remote code execution on the server running the Rails application [2][3]. This can lead to complete compromise of the application and underlying system, including data theft, service disruption, or further lateral movement [3].

Mitigation

The malicious version 3.2.0.3 should be immediately replaced with version 3.2.0.4, which was re-published without the backdoor [3]. Users are also advised to upgrade to any later secure version (e.g., 3.4.1) [1][3]. The vulnerability is not present in versions before 3.2.0.3 or after 3.2.0.3. The affected package is not present in the known exploited vulnerabilities catalog (KEV).