strong_password Ruby gem backdoor stole secrets
strong_password 0.0.7 was published on RubyGems without maintainer control. In Rails production, it fetched Pastebin code and installed a cookie-driven RCE backdoor.
Story
strong_password was compromised before the rest-client incident but exposed the same failure mode. Attackers published version 0.0.7 under the legitimate RubyGems name while the GitHub repository still showed no corresponding project change. The new RubyGems owner appeared as a sparse account named kickball, not the known maintainer.
Tute Costa found the mismatch while reviewing dependency updates. The malicious code had been appended to lib/strong_password/strength_checker.rb; it started a thread, waited a random interval, fetched Ruby from Pastebin, and evaluated it only when Rails.env[0] == "p".
The fetched payload inserted a Rack middleware hook that evaluated Base64 from a crafted ___id cookie. It also phoned home with host URL data. A password-strength library has no reason to read cookies or fetch executable code, but once loaded into Rails it runs inside the application process.
The maintainer confirmed the bogus 0.0.7 release was created on June 25, 2019 and that he no longer had ownership in RubyGems. RubyGems yanked the release, locked the publishing account used for the attack, and restored the maintainer. A few days later, the maintainer said the likely path was an old reused RubyGems password exposed in an unrelated breach. After regaining control, he removed kickball as an owner, reset the account with a unique password and MFA, and published 0.0.8 as the clean release users should move to.
Affected Artifacts
strong_password
- Observed
- 2019-06-25 to 2019-06-29
- Compromised Versions
-
- 0.0.7
- Fixed
- 0.0.8
- Hashes
-
- sha256:c3a46b979b941ecc456639033754f3bad3f5d379df064d4ccd0b54d0fb8e46ea
- The malicious 0.0.7 release was created on 2019-06-25 and appeared only on RubyGems, not in the GitHub repository.
- The legitimate maintainer later said an old reused RubyGems password was the likely source of the account takeover and published 0.0.8 after regaining control.
Incident Context
- Motive
- Credential Theft
- Attribution
- Person
- Cause
- Compromised Account Credentials
- Transitive
- No
- Actor
- Individual Hacker
External References
- CVE-2019-13354: strong_password embedded malicious codesonatype.com
- strong_password v0.0.7 rubygem hijackedwithatwist.dev
- strong_password maintainer comment on the RubyGems account takeovernews.ycombinator.com
- Code execution back door found in Ruby's rest-client librarysnyk.io
- Backdoored Ruby gems stole credentials, injected cryptomining codehelpnetsecurity.com
Source record: oss/attacks/strong_password/meta.yaml