Description

bootstrap-sass is a Ruby gem, the official Sass port of Bootstrap 2 and 3. On March 26, 2019, a malicious version (version 3.2.0.3) of this gem was published to the official RubyGems repository. This modified gem includes a stealthy backdoor that gives attackers remote command execution on server-side Rails applications.

Remediation

Upgrade to the latest version of this Ruby gem (this issue was fixed in version 3.2.0.4).

References

Malicious remote code execution backdoor discovered in the popular bootstrap-sass Ruby gem

bootstrap-sass backdoor github issue

Related Vulnerabilities

WordPress Plugin Ad Inserter-Ad Manager & AdSense Ads Remote Code Execution (2.4.21)

WordPress Plugin Advanced Access Manager Arbitrary Code Execution (2.8.2)

Telerik Web UI Insecure Direct Object Reference

Unauthenticated Remote Code Execution via JSONWS in Liferay 7.2.0 CE GA1

WordPress Plugin WordPress Landing Pages Remote Code Execution (1.9.0)

Severity

High

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Code Execution Acumonitor CWE-95 CVE-2019-10842