CVE-2019-10842
📋 TL;DR
CVE-2019-10842 is a critical backdoor vulnerability in bootstrap-sass 3.2.0.3 that allows unauthenticated remote code execution via a specially crafted cookie. Attackers can exploit this by sending a malicious ___cfduid cookie containing base64-encoded code that gets executed via eval(). This affects any Ruby application using the compromised version downloaded from rubygems.org.
💻 Affected Systems
- bootstrap-sass Ruby gem
📦 What is this software?
Bootstrap Sass by Getbootstrap
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary commands, steal data, install malware, or pivot to other systems.
Likely Case
Remote code execution leading to data theft, service disruption, or cryptocurrency mining malware installation.
If Mitigated
Limited impact if proper network segmentation, WAF rules, and input validation are in place.
🎯 Exploit Status
Exploitation is trivial - attackers simply need to send an HTTP request with the malicious cookie. The vulnerability was actively exploited in the wild before being discovered.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Remove version 3.2.0.3 and use version 3.4.1 or later
Vendor Advisory: https://github.com/twbs/bootstrap-sass/issues/1195
Restart Required: Yes
Instructions:
1. Remove bootstrap-sass 3.2.0.3 from your Gemfile. 2. Update to bootstrap-sass 3.4.1 or later. 3. Run 'bundle update bootstrap-sass'. 4. Restart your Ruby application server.
🔧 Temporary Workarounds
Block malicious cookie at WAF/load balancer
allConfigure WAF or proxy to block requests containing the ___cfduid cookie
# Example nginx config:
location / {
if ($http_cookie ~* "___cfduid") {
return 403;
}
}
Input validation middleware
linuxAdd Ruby middleware to reject requests with suspicious cookie names
# In config/application.rb or middleware:
class CookieFilter
def initialize(app)
@app = app
end
def call(env)
if env['HTTP_COOKIE']&.include?('___cfduid')
return [403, {}, ['Forbidden']]
end
@app.call(env)
end
end
🧯 If You Can't Patch
- Isolate affected systems from internet and critical internal networks
- Implement strict network monitoring for suspicious outbound connections from Ruby applications
🔍 How to Verify
Check if Vulnerable:
Check Gemfile.lock for 'bootstrap-sass (3.2.0.3)' or run 'bundle show bootstrap-sass' and verify versionCheck Version:
bundle show bootstrap-sassVerify Fix Applied:
Run 'bundle show bootstrap-sass' and confirm version is 3.4.1 or later, and verify Gemfile.lock no longer contains 3.2.0.3📡 Detection & Monitoring
Log Indicators:
- HTTP requests with ___cfduid cookie in access logs
- Unusual Ruby eval() errors or backtrace in application logs
- Suspicious outbound network connections from Ruby process
Network Indicators:
- HTTP requests containing '___cfduid' cookie with base64 payload
- Unusual traffic patterns from Ruby application servers
SIEM Query:
source="web_access_logs" AND "___cfduid" OR source="app_logs" AND "eval" AND "bootstrap-sass"🔗 References
- http://dgb.github.io/2019/04/05/bootstrap-sass-backdoor.html
- https://github.com/twbs/bootstrap-sass/issues/1195
- https://snyk.io/blog/malicious-remote-code-execution-backdoor-discovered-in-the-popular-bootstrap-sass-ruby-gem/
- https://snyk.io/vuln/SNYK-RUBY-BOOTSTRAPSASS-174093
- http://dgb.github.io/2019/04/05/bootstrap-sass-backdoor.html
- https://github.com/twbs/bootstrap-sass/issues/1195
- https://snyk.io/blog/malicious-remote-code-execution-backdoor-discovered-in-the-popular-bootstrap-sass-ruby-gem/
- https://snyk.io/vuln/SNYK-RUBY-BOOTSTRAPSASS-174093
