Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list] 
Date: Mon, 9 Oct 2017 20:04:37 -0700
From: Aaron Patterson <tenderlove@...y-lang.org>
To: security@...e.de, oss-security@...ts.openwall.com,
	ruby-security-ann@...glegroups.com
Subject: [CVE-2017-0903] Unsafe Object Deserialization Vulnerability in
 RubyGems

# Unsafe Object Deserialization Vulnerability in RubyGems

There is a possible unsafe object desrialization vulnerability in RubyGems.
It is possible for YAML deserialization of gem specifications to bypass class
white lists.  Specially crafted serialized objects can possibly be used to
escalate to remote code execution. This vulnerability has been assigned the
CVE identifier CVE-2017-0903.

Versions Affected:  >= 2.0.0.
Not affected:       < 2.0.0
Fixed Versions:     2.6.14

Impact
------
When packaging a Gem, RubyGems will store information about the gem (the
"specification") inside the Gem package, and formatted as YAML.  When reading
Gem information, RubyGems will parse that YAML.  Without safeguards, YAML can
be used to instantiate objects in a target system.  If an attacker knows about
the target system, they can use these instantiated objects as a way to
escalate to an RCE via other means like `Marshal.load`.

Normally, a remote code execution flaw isn't a problem in RubyGems because
RubyGems is designed to execute arbitrary code any time a Gem is installed.
However, services that process Gems like RubyGems.org can be impacted by this.
In other words, when used as a client, RubyGems is not impacted.  Applications
that process Gems on the server are impacted.

Releases
--------
The FIXED releases are available at the normal locations.

Workarounds
-----------
For users that can't patch or upgrade, the following monkey patch will
mitigate this risk:

```
module Gem
  class Specification
    WHITELISTED_CLASSES = %w(
      Symbol
      Time
      Date
      Gem::Dependency
      Gem::Platform
      Gem::Requirement
      Gem::Specification
      Gem::Version
      Gem::Version::Requirement
    )

    WHITELISTED_SYMBOLS = %w(
      development
      runtime
    )

    def self.from_yaml(input)
      input = normalize_yaml_input input
      spec = Psych.safe_load(input, WHITELISTED_CLASSES, WHITELISTED_SYMBOLS, true)

      fail Gem::EndOfYAMLException if spec && spec.class == FalseClass

      unless Gem::Specification === spec
        fail Gem::Exception, "YAML data doesn't evaluate to gem specification"
      end

      spec.specification_version ||= NONEXISTENT_SPECIFICATION_VERSION
      spec.reset_nil_attributes_to_default

      spec
    end
  end

  class Package
    def read_checksums gem
      Gem.load_yaml

      @checksums = gem.seek 'checksums.yaml.gz' do |entry|
        Zlib::GzipReader.wrap entry do |gz_io|
          Psych.safe_load(gz_io.read, Gem::Specification::WHITELISTED_CLASSES, Gem::Specification::WHITELISTED_SYMBOLS, true)
        end
      end
    end
  end
end

Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for
the two supported release series. They are in git-am format and consist of a
single changeset.

* 2-6-whitelist-bypass.patch - Patch for 2.6 series

Please note that only the 2.6.x series is supported at present. Users
of earlier unsupported releases are advised to upgrade as soon as possible as we
cannot guarantee the continued availability of security fixes for unsupported
releases.

Credits
-------
Thanks to Max Justicz ( https://mastodon.mit.edu/@maxj ) for reporting this!

-- 
Aaron Patterson
http://tenderlovemaking.com/

View attachment "2-6-whitelist-bypass.patch" of type "text/plain" (4675 bytes)

Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.