bootstrap-sass

Incident Summary

bootstrap-sass gem backdoor enabled RCE.

The popular bootstrap-sass Ruby gem had malicious version 3.2.0.3 published to RubyGems.org after a likely maintainer account compromise. Rails applications that accepted the poisoned release inherited a backdoor in production code paths, turning a front-end asset dependency into a remote command execution channel.

Date: 2019-03-26
Category: Open Source
Target Surface: Package registry
Insertion Phase: distribution
Impact: Backdoor
Cause: Compromised Account/Credentials

What Was Affected

Package bootstrap-sass

LanguageRuby

ComponentLibrary

Artifact typesource archive

Domain typepackage host

Domain rubygems.org

Repository github.com/twbs/bootstrap-sass

Compromised Versions

3.2.0.3

Incident Context

Motive: Unauthorized Access/Control
Attribution: Individual Hacker
Transitive: No
User Impact: 1477
Observed Duration: 0 days

Evidence

Compromised Artifacts

rubygems.org/gems/bootstrap-sass/versions/3.2.0.3

Current Artifacts and Analysis

ironin.it/blog/malicious-backdoor-code-found-in-the-bootstrap-sass-ruby-gem.html

bootstrap-sass gem backdoor enabled RCE.

What Was Affected

Compromised Versions

Incident Context

Evidence

Compromised Artifacts

Current Artifacts and Analysis

Indicators and Changes

Hashes

External References

Source Data