CVE-2019-10842: Code Injection
First published: Thu Apr 04 2019(Updated: )
Arbitrary code execution (via backdoor code) was discovered in bootstrap-sass 3.2.0.3, when downloaded from rubygems.org. An unauthenticated attacker can craft the ___cfduid cookie value with base64 arbitrary code to be executed via eval(), which can be leveraged to execute arbitrary code on the target system. Note that there are three underscore characters in the cookie name. This is unrelated to the __cfduid cookie that is legitimately used by Cloudflare.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Getbootstrap Bootstrap-sass | =3.2.0.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2019-10842
- https://github.com/twbs/bootstrap-sass/issues/1195
- https://snyk.io/blog/malicious-remote-code-execution-backdoor-discovered-in-the-popular-bootstrap-sass-ruby-gem/
- https://snyk.io/vuln/SNYK-RUBY-BOOTSTRAPSASS-174093
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bootstrap-sass/CVE-2019-10842.yml
- https://github.com/advisories/GHSA-vqqv-v9m2-48p2 (Advisory)
- http://dgb.github.io/2019/04/05/bootstrap-sass-backdoor.html
Frequently Asked Questions
What is CVE-2019-10842?
CVE-2019-10842 is a vulnerability that allows an attacker to execute arbitrary code on the target system.
How severe is CVE-2019-10842?
CVE-2019-10842 has a severity rating of critical with a CVSS score of 9.8.
Which software is affected by CVE-2019-10842?
The software affected by CVE-2019-10842 is bootstrap-sass version 3.2.0.3 downloaded from rubygems.org.
How can the vulnerability in bootstrap-sass 3.2.0.3 be fixed?
To fix the vulnerability in bootstrap-sass 3.2.0.3, upgrade to version 3.2.0.4.
Where can I find more information about CVE-2019-10842?
You can find more information about CVE-2019-10842 at the following references: [link1], [link2], [link3].
- collector/github-advisory-latest
- alias/GHSA-vqqv-v9m2-48p2
- alias/CVE-2019-10842
- collector/github-advisory
- collector/nvd-index
- collector/nvd-cve
- agent/type
- agent/author
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/references
- agent/last-modified-date
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/trending
- agent/tags
- agent/source
- package-manager/rubygems
- vendor/getbootstrap
- canonical/getbootstrap bootstrap-sass
- version/getbootstrap bootstrap-sass/3.2.0.3