Backdoor vulnerability in open source tool exposes thousands of apps to remote code execution

The 2017 data breach at Equifax was possible because the company did not act to resolve a flaw in the open source Apache Struts framework.

Hackers have designed a back door into an open source framework that has been downloaded roughly 28 million times by building a malicious version that masquerades as the real thing.

A compromised version of the website development tool bootstrap-sass was published to the official RubyGems repository, a hub where programmers can share their application code. The open source security firm Snyk alerted developers to the issue Wednesday, advising users to update their systems away from the infected framework (version 3.2.0.3).

“That doesn’t mean there are something like 27 million apps out there using this,” said Chris Wysopal, chief technology officer at app security company Veracode. “[But] when you’re using open source packages to build your applications, you’re inheriting many of the vulnerabilities. … But bootstrap-sass is a popular component used by enterprises and startups so there’s potentially thousands of applications affected by this.”

While the vulnerability is serious — hackers can exploit it for remote code execution — the issue also highlights how pervasive such flaws can become if they’re not fixed quickly, according to application security experts. The 2017 data breach at Equifax was possible because the company did not act to resolve a flaw in the open source Apache Struts framework.

“If you’re a person using bootstrap-sass you’re on your way to becoming the next Equifax if you don’t patch,” said Matt Konda, CEO of the app security company Jemurai and a former board member at the Open Web Application Security Project. “It’s a success story of somebody finding this today, rather than in two years we find out we have another Equifax, but even as this is becoming a first class thing, people don’t always patch.”

Eighty-one percent of the chief information officers and chief information security officers polled in a Tanium survey published this week said they have delayed essential updates at least once, while 52 percent said they did more than once.

In this case, hackers appeared to build a malicious copy of bootstrap-sass by compromising the machine or phishing the credentials of a developer, Wysopal said. Upon accessing the account, the hacker appears to have simply uploaded a hacked version of an already-popular library. An initial Snyk estimate suggests “roughly 1,670 GitHub repositories that may have been exposed to the malicious library through direct use.”

Such an attack is alarming, even with the quick release of a security patch, Wysopal said. Much like a zero-day, a backdoor in an open source framework would be known only to an attacker. Even when it’s detected, that hacker still has time on their side.

“Everyone who plants backdoors expects them to be found within days,” said Wysopal. “But it’s still powerful because the developer has to detect that, create new code and then push out the update. It’s one of those things where it doesn’t really matter if it was quick. Prevention is what we need.”

Researchers raised similar concerns last year when hackers inserted a backdoor into another open source library capable of stealing funds from bitcoin wallets. Before that, security pros detected another vulnerability in the Apache Struts framework.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure