CVE-2022-29176
📋 TL;DR
This vulnerability in RubyGems.org allowed unauthorized users to remove and replace certain gems from the package registry. It affected gems with dashes in their name that were either created within 30 days or hadn't been updated for over 100 days. The vulnerability could lead to supply chain attacks where malicious code is injected into legitimate packages.
💻 Affected Systems
- RubyGems.org
📦 What is this software?
Rubygems.org by Rubygems
⚠️ Risk & Real-World Impact
Worst Case
Attackers replace widely-used gems with malicious versions, leading to supply chain compromise affecting thousands of applications and potential data breaches.
Likely Case
Targeted attacks against specific gems to inject backdoors or steal credentials from applications using those gems.
If Mitigated
Applications using Bundler in frozen/deployment mode are protected from silent version switches, limiting impact to audit and cleanup.
🎯 Exploit Status
Requires RubyGems.org user account but not gem ownership authorization. No evidence of exploitation found in audits.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: RubyGems.org patched on May 5, 2022
Vendor Advisory: https://github.com/rubygems/rubygems.org/security/advisories/GHSA-hccv-rwq6-vh79
Restart Required: No
Instructions:
1. RubyGems.org has been patched server-side. 2. No client-side action required for the vulnerability itself. 3. Users should audit their Gemfile.lock for suspicious changes.
🔧 Temporary Workarounds
Use Bundler frozen/deployment mode
allPrevents silent gem version switches by locking dependencies
bundle install --frozen
bundle install --deployment
🧯 If You Can't Patch
- Audit Gemfile.lock for gems where platform changed without version change (e.g., gemname-3.1.2 to gemname-3.1.2-java)
- Implement dependency pinning and review all gem updates before deployment
🔍 How to Verify
Check if Vulnerable:
Check if you used RubyGems.org before May 5, 2022 and have gems meeting the vulnerable criteriaCheck Version:
Not applicable - server-side fixVerify Fix Applied:
RubyGems.org has been patched server-side. Verify by checking advisory status and auditing your Gemfile.lock📡 Detection & Monitoring
Log Indicators:
- Unexpected gem yank notifications
- Gem version changes without owner action
Network Indicators:
- Unexpected gem downloads from RubyGems.org
SIEM Query:
Search for gem yank events where actor != gem owner🔗 References
- https://github.com/rubygems/rubygems.org/security/advisories/GHSA-hccv-rwq6-vh79
- https://hackerone.com/bugs?subject=rubygems&report_id=1559856
- https://security.netapp.com/advisory/ntap-20220616-0002/
- https://github.com/rubygems/rubygems.org/security/advisories/GHSA-hccv-rwq6-vh79
- https://hackerone.com/bugs?subject=rubygems&report_id=1559856
- https://security.netapp.com/advisory/ntap-20220616-0002/
