# Installing a crafted gem package may create or overwrite files

RubyGems didn't validate the gem metadata name field, so a crafted gem with a `../` name wrote files outside the install dir, even overwriting another gem's binaries.

- Payout: $1,000
- Severity: high
- Program: RubyGems
- Credited: mame
- Disclosed: 2017-08-31
- CVE: CVE-2017-0901
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/243156
- Library page: https://bugbountylibrary.com/r/h1%3A243156
- Tags: domain:oss impact:integrity impact:rce kind:bounty platform:hackerone sev:high tech:ruby technique:source-review vuln:path-traversal

**Target:** gem install / metadata.gz name field
**Root cause:** The `name` field in metadata.gz is used to build the install path without sanitization, so path traversal sequences escape the gem directory.
**Steps:**
1. Craft a gem whose metadata.gz `name` is `../../../../../../../../../../tmp/malicious`
2. `gem install malicious.gem --no-doc`
3. Observe `/tmp/malicious-0/BOOOOM` created outside the gem dir
4. For overwrite: set `name` to `../gems/rack` and include `bin/rackup`
5. `gem install rack -v 2.0.3` then `gem install replace-rackup.gem --no-doc`
6. Run `rackup`; it prints `BOOOOM!`
**How found:** Noticed no validation of the `name` field in metadata.gz and tested traversal strings to see where install paths landed.
**Exploitation:** Attacker ships a malicious .gem; victim runs `gem install`. The traversal name places attacker-controlled files into arbitrary directories (e.g. another gem's bin/), replacing trusted executables like `rackup` that later execute attacker code.
**Escalation:** Overwriting an installed gem's executable (rackup) turns file-write into code execution when the victim runs that command.
**Insight:** Gem metadata fields (name/version) feed install paths; test traversal in package metadata, and target overwriting another installed gem's bin/ to convert arbitrary write into code execution.