CVE-2024-21654: Rubygems.org MFA Bypass Vulnerability

CVE-2024-21654 Overview

CVE-2024-21654 is an authentication bypass vulnerability in Rubygems.org, the Ruby community's gem hosting service. The vulnerability allows attackers to bypass Multi-Factor Authentication (MFA) protection through a workaround in the forgotten password form, potentially leading to complete account takeover even when users have MFA enabled.

Critical Impact

Attackers can bypass MFA protections and take over Rubygems.org accounts, potentially enabling supply chain attacks through malicious gem package updates.

Affected Products

• Rubygems.org (versions prior to commit 0b3272a)

Discovery Timeline

• 2024-01-12 - CVE-2024-21654 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-21654

Vulnerability Analysis

This vulnerability represents a serious authentication bypass flaw (CWE-287, CWE-306) that undermines the security guarantees of Multi-Factor Authentication. Users who enabled MFA on their Rubygems.org accounts expected protection against account takeover scenarios, particularly in cases where their email accounts might be compromised. However, a logic flaw in the password reset flow allowed attackers to circumvent this critical security control entirely.

The vulnerability is particularly dangerous in the context of Rubygems.org because successful account takeover could enable supply chain attacks. An attacker gaining access to a gem maintainer's account could push malicious versions of popular Ruby packages, potentially affecting thousands of downstream applications and developers.

Root Cause

The root cause lies in the session verification logic within the application controllers. The vulnerable code used password_session_active? as the verification check, which did not properly enforce MFA verification requirements. This method only checked if a password session was active without ensuring the user had completed the full MFA verification flow.

The fix replaced calls to password_session_active? with verified_session_active?, ensuring that MFA verification is properly enforced before allowing sensitive account operations.

Attack Vector

The attack can be executed remotely over the network without any user interaction. An attacker who has compromised a victim's email account could:

1. Navigate to the forgotten password form on Rubygems.org
2. Initiate a password reset for the target account
3. Exploit the MFA bypass to complete the password change without MFA verification
4. Gain full access to the victim's account despite MFA being enabled

The following patches address the vulnerability:

Patch in app/controllers/adoptions_controller.rb:

 
   before_action :find_rubygem
   before_action :verify_ownership_requestable
-  before_action :redirect_to_verify, if: -> { current_user_is_owner? && !password_session_active? }
+  before_action :redirect_to_verify, if: -> { current_user_is_owner? && !verified_session_active? }
 
   def index
     @ownership_call     = @rubygem.ownership_call

Source: GitHub Commit Reference

Patch in app/controllers/application_controller.rb:

     response.headers["Expires"] = "Fri, 01 Jan 1990 00:00:00 GMT"
   end
 
-  def password_session_active?
-    session[:verification] && session[:verification] > Time.current && session.fetch(:verified_user, "") == current_user.id
-  end
-
   def set_error_context_user
     return unless current_user
 

Source: GitHub Commit Reference

The fix removes the vulnerable password_session_active? method and replaces its usage with verified_session_active?, which properly enforces MFA verification requirements.

Detection Methods for CVE-2024-21654

Indicators of Compromise

• Unexpected password reset emails for Rubygems.org accounts
• Account access from unfamiliar IP addresses or geolocations
• Unauthorized changes to gem ownership or gem package contents
• New API key generation without user initiation
• Modifications to account security settings (MFA disabled, email changed)

Detection Strategies

• Monitor Rubygems.org account activity logs for password reset operations followed by immediate login without MFA challenge
• Review authentication logs for sessions that bypassed MFA verification during password recovery flows
• Alert on gem version publications occurring shortly after password reset events
• Implement anomaly detection for account behavior changes post-password reset

Monitoring Recommendations

• Enable email notifications for all account security events on Rubygems.org
• Subscribe to security advisories from the Rubygems.org team via the GitHub Security Advisory
• Monitor dependency update notifications for unexpected gem version changes
• Implement gem integrity verification in CI/CD pipelines to detect supply chain compromises

How to Mitigate CVE-2024-21654

Immediate Actions Required

• Verify your Rubygems.org account has not been compromised by reviewing recent login activity and API key usage
• Rotate all Rubygems.org API keys as a precautionary measure
• Review recent gem publications for any unauthorized changes
• Enable additional security notifications if not already configured
• Consider re-enabling or strengthening MFA configuration after the patch is applied

Patch Information

The vulnerability has been patched in commit 0b3272a. Since Rubygems.org is a hosted service, the fix has been deployed server-side. Users do not need to take action to apply the patch, but should verify their accounts were not compromised before the fix was deployed.

For more details, see the GitHub Security Advisory and the patch commit.

Workarounds

• Review and audit all recent account activity for signs of unauthorized access
• Change your password and regenerate API keys if you suspect compromise
• Use hardware security keys for MFA where supported for additional protection
• Implement gem signing and verification for published packages to ensure integrity

# Verify your gem integrity by checking signatures
gem cert --list
gem fetch <gem_name> --verify