# Request Hijacking Vulnerability in RubyGems 2.6.11 and earlier

RubyGems client trusted unvalidated DNS SRV responses for gem server API discovery, letting a MiTM redirect gem installs to an attacker host and achieve RCE.

- Payout: hidden
- Severity: high
- Program: RubyGems
- Found by: claudijd
- Disclosed: 2017-08-30
- CVE: CVE-2017-0902, CVE-2015-3900, CVE-2015-4020
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/218088
- Library page: https://bugbountylibrary.com/r/h1%3A218088
- Tags: area:oss domain:oss impact:integrity impact:rce kind:bounty platform:hackerone sev:high tech:ruby technique:source-review vuln:misconfiguration vuln:rce

**Target:** RubyGems client gem command / Gem::RemoteFetcher API discovery
**Root cause:** The SRV DNS lookup result for _rubygems._tcp.<host> is only checked with a suffix regex against the source hostname, so a target like evil.com/api.rubygems.com passes the check and points the client at an attacker-controlled server.
**Steps:**
1. Observe default discovery: `dig srv _rubygems._tcp.rubygems.org +short` returns `0 1 80 api.rubygems.org.`
2. MiTM the DNS response and return an SRV record whose target is `evil.com/api.rubygems.com` (passes the `/\.rubygems.org\z/` suffix check)
3. Run the PoC RubyDNS responder answering all SRV queries with `transaction.respond!(0,0,53,"evil.com/api.rubygems.com")`
4. Client resolves API host to attacker server and downloads/installs gems from it
5. Attacker trojans gem code executed via extensions API at install time
**How found:** Reading Gem::RemoteFetcher's SRV discovery code and noticing the target validation was only a suffix regex, which a path-containing hostname like evil.com/api.rubygems.com satisfies.
**Exploitation:** A network/MiTM attacker poisons the SRV DNS reply so the gem client's API host resolves to an attacker-controlled server in an alternate domain; the client then pulls malicious gems and executes attacker code at install time via the extensions API.
**Insight:** Suffix-regex host validation is bypassable when the value can contain a path or extra labels; check how DNS SRV/API-discovery targets are validated, since a poisoned record can redirect package fetches to an attacker domain.