Embedded malicious code (backdoor) in RubyGems fake vendor products - #VU27108

Vulnerability identifier: #VU27108

CSH Severity: Critical

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: N/A

CWE-ID: CWE-506

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a remote attacker to gain unauthorized access to the application.

The vulnerability exists due to presence of embedded malicious functionality in the application code (aka backdoor) that allows a remote attacker to gain unauthorized access to the application.

capistrano_rails-subdir
lita_onewheel-beer-btu
aliyun_mts
archive-lister
hello-kelvinst
active-model-policy
aasm-ohm_persistence
awesome-print_carrier_wave_uploader
first-giving_api
bosh_plugin-generator
kevin-thompson
mars-rover_alvin
administrate_field-mobility
activemodel-base64-validator
apress_changelogger
ar-lightning
multi-movingsign
beta-invites
rubylove-playing-cards
37_pieces-of-flair
assemblyline_formatter
secondhand_spider
alacrity-client
answers_ruby-client
app_cli
activerecord-serialize-coders
activerecord_publishable
spider_node
lita_onewheel-beer-abvpub
activerecord_db-tools
acme_heisenberg
activerecord_locking-symbolic
anything_slider
lita_onewheel-beer-growlers
ackintosh-net-empty-port
ellen_weather
living-dead
acts-as_fuzzy_search
lita_onewheel-beer-upperlip
addy-caddy_client
kevins-propietary_brain
acme_leeway
acme-base64-hexagrams
bedrock_capistrano-uploads
active-model-permalink
airbrake-stats
battery-growl
doge_chef-formatter
aws-blue_green_deploy
danger_brakeman
capistrano_auth-subscriber
cache-stats
active-model_policy
arethusa-plugin_generator
assets-pipeline
batched-query
dot-rake_tasks_in_rails
aliyun_slb
aliyun_rds
active-admin_globalize3_locale_selector
act-as_serializable
language-mixer
brakeman-translate_checkstyle_format
aws-upload
lines-mixer
alias-to_method
a1437ky-bmi3
commandsy_plugin
a1330ks-bmi
a1447ll-test
git-team_stats
capistrano3_drupal
drupal-fu
telegram-notifications
battering-ram
bulldoggy_filesystem
admob-site_stats
active-model-attributes_validation
alias-scope
acts-as_multilingual
ActiveAdmin_Globalize3-inputs
alerty_plugin-ikachan
alerty_plugin-slack
actionmailer-localized-preview
ar-database_duplicator
http-statsd
application-module
active-model_serializers-cancan
activemodel-can-validator
asset-link
adwords-scraper
access-policy_rails
appfigures-client
accepts-nested_serialized_attributes
alidayu-api
application-config
speed-spider
movie-spider
murmuring-spider
activemodel-immutable-validator
playing-cards
activemodel-ipaddr-validator
assembla-cli
asana_cli
access-policy-rails
also-validates
anything-slider_rails
ability-engine
ruby-playing_cards
forgiving-nil
alerty_plugin-mail
github_release-stats
chef_cloudsearch
batch-actions
aws-cloud_search
ar_find-in-batches-with-order
a-special-day
a-stupid_test_gem
activerecord_postgresql-expression
actioncontroller-parameter-filter
devino-sms
ad-search
a-special_day
movingsign-api
a-stupid-test_gem
rate-beer
indonesian-province
basic_stats
atlas-client
ceedling_autorake
a1409yo-health
commission-junction_stats
artisan_plugin
aliyun-ruby_api
chalk_rake
dt_rake
gimme-vins
lita_onewheel-beer-wayfinder
activemodel-behavior-validator
execute-with_rescue_with_airbrake
moving-words
3months-staff_schedule
a1436mm-age
acts-as_localized
acts-as_read_only_i18n_localised
adb_sdklib
a1439ty-bmiV3
font_roboto-rails
a1412tk-bmi
cucumber-rake_runner
binary-search_frequency
asset-uploader
app_deployer
3months-staff-schedule
authenticated-client
auth-client
act-as_nameable
action-parameter
apigee-cli
at-least_one_existence_validator
applidget_oauth2
apidone_client
ar-json_serialize
battle_on
fluent_plugin-datadog-statsd
any_validate
authenticator_client
auto-validate
alephant_logger-statsd
current-weather
city-search
activemodel-url-validator
bisearch-enzim_hu
bosh-lastpass_plugin
atacama-client
airbrake_graylog2
ability-list
adtech_api-client
acts-as_publicable
adapter_elasticsearch
bitmovin_api
hack-cards
acme_bleach
apn-client
apod_cli
administrate_field-password
ali-mns
applied-css
a14z6ch-elapsed_days
auth_transis-client
spider-bot
administrate_field-paperclip
beta-tools
fluent_plugin-stats-notifier
arel-search
active-model_version_serializers
assets-offline
apple-store_search
apocalypse_client
a14z6ch-elapsed-days
alipay-global
branch-raker
brightbox_boxgrinder-plugins
area-code_validator
alerty-plugin-amazon-sns
fluent_plugin-dogstatsd
backstop_deploys
abbish-sequel_plugins
adn_cli
alcatraz_client
lita_onewheel-beer-pints
active-model_serializers_pg
activemerchant-banklink
datadog-proxy
a1426kt-prime-number
attr-searchable
absa_notify-me
99designs_tasks
active-record_samplooper
fluent_plugin-statsite
beer-in_the_evening
access-policy
aliyun-sls
a1426kt-prime_number
nhtsa-vin
angel-list
cocoapods_icemobile-plugin
apibanca_client
asterisk_ari-client
fluent_plugin-dogstatsd-mediba
acts-as_keywordable
airservice-build_tools
active-explorer
ar-publish_control
aliyun-sls_sdk
active-pubsub
addons_client
amoeba-deploy_tools
abbyy_cloud
ace_client-ext
act-as_importable
spider-monkey
appium-doc_lint
alphabetic-paginate
ama-validators
android_publisher
agile_cli
a_test-gem
galvinhsiu-active-cart
assemblyline_cli
a15666011-konagayoshi
autoproj_stats
a1548sy-yamamoto
active-press
age-validator
arproxy-plugin-mysql-casual_log
stuck-it_up
rack_envinspector
github_org-stats
doge-linguist
telegram-bot_api
a15z8my-name
api-deploy
lita_telegram
acmesmith_ns1
abbreviated-methods
doge-helper
aws_codedeploy-agent
a1535yt-gem
a1521hk-minitest-practice
a1624-bmi
a1616ts-gem
a1508ki-ika
a1447ll-mini_test
a1501da-birthday
a1510jy-bmi
aliyun_push
a1632ma-ano
a15z7kn-niitsuma_2016_gem
active-hash-like
dogapi_demo
active-model_serializers-hash_wrapper
acts-as_splittable
cocoapods_fixbugs-plugin
first-gem_rakesh
dragonfly_cloudinary-datastore
fluent_plugin-airbrake-logger
android_command-line-tools
adapter_sqlite3
acts-as_liked
acts-as_likeable
a1521hk-minitest_practice
apache-sling_api_client
auto-localize
em_synchrony-dataone-vin
foot-stats
ajax-submit_rails
acts-as_commentable_with_replies
activerecord_implicit-order
array-xml-serialization
ba-upload
act-blue_reporter
alidns_ruby
batch-it
activemodel_validators
acts-as_subscribable
attribute-normalizer-extras
argentinian_validations
enpit-weather
approval_ratings-cli-app
barometer-weather-bug
apress_validators
bosh-cli_plugin_consul
abn-validator
alias-class
dark-sky_weather
twitter-cards
capistrano_copy-subdir
blinkman-twitter-search
bin-search
angular_turbolinks
arctica_autorization-rails-plugin
android-string_resources_validator
referral-candy
candy_-sql
auto-scaling_methods
apress_moysklad
aws_elasticsearch
beer-bash
aligned-table
at_validations
aliyun_mqs
alphabet_rocker
active-serializer
a1521hk-age
active-model_serializers-matchers
active-merchant_mollie
active_profiling
a1420ks-bmi
address-validator
apache-felix_api_client
amplitude_api
dragonfly_cloudinary
apache-felix_webconsole_client
active-model_serializers-jsonapi_embedded_records_deserializer
benchmark_plot
active-admin-advanced_create_another
airbrake-notifying_threads
aliyun-live
fluent-plugin-haproxy-stats
acmesmith_designate
beerdb-api
capistrano-telegram-notification
capistrano_telegram-notification
royal-mail_api
activerecord-suppress-range_error
address-validate
arabic-normalizer
active-merchant-mollie
fluent_plugin-statsd-event
edmunds-vin
api-batch
autoexec-bat
moving-average
activerecord-msgpack-serializer
acts-as_explorable
capistrano_airbrake
auto-flick
aliyun_mq-sdk
aasm-active-fedora
font_stack
airbrake-proxy
selenium-spider
alias-helper
alias-metrics
omniauth_mixer
algolia-places
ali-dayu
banner-jobsub
lita_telegram-plus
batali_wedge
active-redis_stats
vagrant_hvinfo
apptuit_fluent-plugin
atlassian-plugin_installer
alipay-escrow
access-lint
batch-translations
aasm-history
activerecord-rescue-from_duplicate
acmesmith_google-cloud-storage
abiquo_api
acmesmith_verisign
act-as_enumerable
agave_client
lita_onewheel-beer-tin-bucket
active-comparison_validator
lita_onewheel-beer-loyal-legion
damn_weather
after-the_deadline
alerty_plugin-datadog-event
alerty-plugin-datadog-event
active-record_serialize_json
activerecord_jdbcsplice-adapter
action-component
rails_test-serving
ar_octopus-replication-tracking
comic-vine
aliyun_sdk-core
active-record_stats
a1520mk-exercise4
allocation-stats
application-digester
airbrake-user_attributes
assemblyline_ruby
bbs-uploader
a15745105-ichinokii
spider_src
telegram-bot_ruby
active-record_fix_integer_limit
angular-form_validation
activeadmin-jfu_upload
activemerchant_payline
spider-html
accredible_ruby
a1539kh-calculator
twitter_vine
doge-woof
aliyun-mns
codestats_metrics-reporter
font-assets
arethusa_cli
datadog_cli
arethusa_client
auto_deploy-test
aem_deploy
accredible_api-ruby
applicious-utils
activerecord-safe-initialize
danger_apkstats
capistrano_rake
capistrano_runit-rake
a1630ty-a1630ty
active-replica
batch_rails2
fortnite-api
action-meta_tags
acmesmith_google-cloud-dns
activemerchant_clickandbuy
fluent_plugin-airbrake-python
archive-uploader
cloud-search
android-lint_translate_checkstyle_format
chef_handler-datadog-demo
alexa-plugin_generator
airbrake-user_attributes_rails5
activerecord_denormalize
asset-pipeline
batch-audio_convert
active-model_serializers_matchers
airbrake_statsd
active-model_serializers_binary
acme_pki
bosh_plugin-pipeline
bunto_press
action-pubsub
assets-live_compile
activerecord-pluck-in_batches
candy-check
action-cable_subscription_adapter
abbyy_ruby
batali_infuse
bosh-cli_plugin_redis
attr-validator
archivist_client
batali_tk
cards-lib
gamer-stats
active-tools
lita_onewheel-beer-apex
active-public_resources
telegram-meetup_bot
3scale-time-range
aws_s3-deploy
3scale-time_range
get-stats
commonmarker_pluggable
active-delivery
active-record_lite
alephant_publisher-request
capistrano-scm-git-with_submodule_and_resolv_symlinks
jenkins-statsd
asset-symlink
activerecord-strict_validations
active-application
adequate-serializer
deriving-license
belong_plugin-rds-pgsql-log
cap_drupal-multisite
telegram-bot_middleware
cafepress-api
acts-as_publishable
accesslint_ci
action-mailer_cache_delivery
fluent_plugin-stats
apress_documentation
active-admin-duplicatable
alipay-dualfun
action-links
aliyun_odps
ab-panel
a15745105-ichinoki
backbone_subroute-rails
active-model_serializers_cancancan
astroboa_cli
batsd_dash
aptly-cli
activerecord_databasevalidations
artoo_crazyflie
active-replicas
rspec-candy
cordova_rake
ascii-press
resque-stuck_queue
applogger_ruby
apple_news-client
application-insights
auto-click
dog-biscuits
aliyun-open-search
audiobank_client
aliyun-open_search
asciidoctor_pdf-linewrap-ja
acme_cli
association-validator
active-record_inline_schema
telegram_bot-types
activerecord_duplicate
datadog_notifications
divining-rod
alephant_publisher
administrate-field-belongs-to_search
blade-sauce-labs_plugin
applicaster_logger
jmcnevin-rghost-barcode
assembly_client
datadog-apm
application-seeds
apns-polite
claide_plugins
fig-rake
asciidoctor_bibliography
telegram_bot-ruby
batman_rails
aptible_cli
bard_rake
ansible-tower_client
acts-as_better_tree
em_statsd
lita_onewheel-beer-craftpourhouse
activeadmin-globalize_inputs
active-subset-validator
barely-searchable
api-geo_client
font_league
jaconda-telegram
batch-insert
lang-cards
acts-as_crafter
bunto-test_plugin_malicious
dragonfly_activerecord
active-subset_validator
active-model_validators_ex
contributors-stats
aker-cas-cli
apple-class_client
cat_dog
applicant-tracking_api
education-stats
activerecord-globalize
ruboty_telegram
active-model_type_validator
capistrano_scm-gitsubmodules
bunto-test_plugin
activerecord-forbid-implicit_connection_checkout
crl-watchdog
capistrano_telegram
agnostic_duplicate
gitstats_ruby
moving-images
1-as_identity_function
activeadmin_mongoid-localize
active-search
amazon_kinesis-client-ruby
royal-mail_scraper
chef_handler-statsd
apiotics-aws_iot_client
apiotics-aws_client
alphabetical-paginate_uk
1-as-identity_function
act-as_time_as_boolean
a1447ll-hpbd
actionview-link-to_block
acceptance-tests_support
active_model-email-validator
cinch_logsearch
ab_split
audio-mixer-sox
ach-client
acts-as_list_with_sti_support
activerecord-database-validations
fluent_plugin-statsd
em_statsd-ruby
active-model-password
halo-stats
aws-sns_subscription
campaign-monitor_subscriber
aliseeks-api
active-validator
actionview-link-to_blank
cinch_weatherman
font_fabulous
game-shuffle_cards
active-link_to
chef-partial-search
active-model-password_reset
accessible-tooltip
amplifypay-ruby
wordify-stuckiest
alive-state
acception_subscriber
omniauth_marvin
delayed_plugins-airbrake
emque_stats
active-model_serializer_plus
active-admin_theme
capistrano_stats
allq-client
arb-spider
aastra-xml-api
aastra-xml_api
biblesearch_api
active-support_alias_class_method
bankgiro-inbetalningar
alchemy-pg-search
api-client_builder
ardm_sqlite-adapter
ardm_validations
acception_client
activeadmin-searchable-select
active-rest_client
active-model_validates_intersection_of
active-model_serializers_validator
active-admin_filters_visibility
active-publisher
ar_serialize-helpers
asset-host_client
ardm_serializer
beta_pod
activerecord-json_validator
batch_rails
array_subindex
abstract-api_wrapper
fluent_plugin-statsd-output
amazon_search
abstract-importer
actionmailer-inline_css
angular_file-upload-rails
acpc-poker-player_proxy
active-model-better_errors
acpc-poker_player_proxy
admiral-stats_parser
apress_api
about-pos
apitool_client
activemodel-email-address_validator
assets_publisher-for-hanami
gitstats_rb
aai10_mechanize
acme_client
lita_onewheel-beer-base
a1408nw-Ounennhei
binary-search_tree
advisors-command_client
activerecord_like
acpc-poker_match_state
acpc-poker-match_state
apple-dep_client
lita_onewheel-beer-wework
alphabetical-paginate
acquia-toolbelt
alephant_publisher-queue
3scale-client
catarse-paypal_express
active-scaffold_config_list_vho
active-scaffold_batch_vho
spider_gazelle
acpc-poker_basic_proxy
acpc-poker-basic_proxy
acts-as_journalized
seeing-is_believing
lita_onewheel-beer-baileys
dradis_brakeman
dradis_nmap
dradis_ntospider
ae-validates-timeliness
workarea-gift-cards
allscripts-unity_client
acme_smileage
asset-pipeline_i18n
adyen_ruby-api-library
blinkist_airbrake-scrubber
active-admin_import
airbrake_api
font_awesome-sass-mixins
font_awesome-sassc
font_awesome-sass-c
active-validation
action-subscriber
font_awesome-sass
blacklight-advanced_search
acpc-poker_types
acpc-poker-types
appium-lib
aspose-slides_cloud

• https://thehackernews.com/2020/04/rubygem-typosquatting-malware.html

• Backdoors in multiple gems for Ruby