CVE-2019-15224 rest-client Gem Contains Malicious Code

Critical 9.8 Published 19 Aug 2019 Updated 5 Aug 2024

A backdoor in the rest-client gem allows attackers to execute arbitrary code on systems using affected versions.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2019-15224?

CVE-2019-15224 is a critical code injection vulnerability in n/a, published on 19 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions <=1.6.9 and >=1.6.14 are unaffected.

Weakness: CWE-94

Which versions are affected by CVE-2019-15224?

22 open source packages ship an affected version, including cron_parser, awesome-bot and bitcoin_vanity. It affects 1 product.

Package	Affected	Fixed in
`cron_parser` RubyGems	All versions	None
`cron_parser` RubyGems	All versions	None
`cron_parser` RubyGems	From `1.0.13` to `1.0.14`	None
`cron_parser` RubyGems	From `1.0.13` to `1.0.14`	None
`awesome-bot` RubyGems	All versions	None
`awesome-bot` RubyGems	All versions	None

16 more packages

`bitcoin_vanity` RubyGems	All versions	None
`bitcoin_vanity` RubyGems	All versions	None
`blockchain_wallet` RubyGems	All versions	None
`blockchain_wallet` RubyGems	All versions	None
`capistrano-colors` RubyGems	All versions	None
`capistrano-colors` RubyGems	All versions	None
`coin_base` RubyGems	All versions	None
`coin_base` RubyGems	All versions	None
`coming-soon` RubyGems	All versions	None
`coming-soon` RubyGems	All versions	None
`doge-coin` RubyGems	All versions	None
`doge-coin` RubyGems	All versions	None
`omniauth_amazon` RubyGems	All versions	None
`omniauth_amazon` RubyGems	All versions	None
`rest-client` RubyGems	From `1.6.10`	`1.7.0`
`rest-client` RubyGems	From `1.6.10`	`1.7.0`

Products include Rest-Client Project Rest-Client.

How do I fix CVE-2019-15224?

Upgrade to a fixed version.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2019-15224 being exploited?

There is no known exploitation of CVE-2019-15224 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Sources

Also known as GHSA-333g-rpr4-7hxq.