bootstrap-sass CVE-2019-10842 Arbitrary Code Execution Vulnerability

Bugtraq ID:	108468
Class:	Input Validation Error
CVE:	CVE-2019-10842
Remote:	Yes
Local:	No
Published:	Mar 27 2019 12:00AM
Updated:	Mar 27 2019 12:00AM
Credit:	Derek Barnes
Vulnerable:	getbootstrap bootstrap-sass 3.2.0.3
Not Vulnerable:	getbootstrap bootstrap-sass 3.2.0.4

bootstrap-sass CVE-2019-10842 Arbitrary Code Execution Vulnerability

bootstrap-sass is prone to an arbitrary code-execution vulnerability.

Attackers can exploit this issue to execute arbitrary code in the context of the application. Failed attacks may cause a denial-of-service condition.

bootstrap-sass 3.2.0.3 is vulnerable; other versions may also be affected.

bootstrap-sass CVE-2019-10842 Arbitrary Code Execution Vulnerability

The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.

bootstrap-sass CVE-2019-10842 Arbitrary Code Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

bootstrap-sass CVE-2019-10842 Arbitrary Code Execution Vulnerability

References:

• 3.2.0.3? #1195 (twbs/bootstrap-sass)
  
• Affecting bootstrap-sass gem, versions >=3.2.0.3, <3.2.0.4 (snyk.io)
  
• Bootstrap Sass Backdoor (dgb.github.io)
  
• getbootstrap Homepage (getbootstrap)
  
• Malicious remote code execution backdoor discovered in the popular bootstrap-sas (snyk.io)
  
• Bug 1697482 (CVE-2019-10842) - CVE-2019-10842 rubygem-bootstrap-sass: backdoor (Redhat)
  
• CVE-2019-10842 (Redhat)