# DNS SRV lookup of file:// sources enables local hijacking of gems

RubyGems issued DNS SRV lookups for file:// sources, letting a DNS spoofer prepend a path prefix and redirect gem fetches to attacker-controlled local gems.

- Payout: $500
- Severity: high
- Program: RubyGems
- Credited: b9629eebd06fb8f0680ecbdef829e
- Disclosed: 2018-12-11
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/411519
- Library page: https://bugbountylibrary.com/r/h1%3A411519
- Tags: domain:oss impact:rce kind:bounty platform:hackerone sev:high tech:ruby technique:chained technique:source-review vuln:misconfiguration vuln:path-traversal

**Target:** gem client remote_fetcher api_endpoint
**Root cause:** api_endpoint performs SRV lookup for file:// and s3:// sources and allows SRV target to inject a path prefix, since the host component of file:// URLs is ignored.
**Steps:**
1. Set up file:// repo: `gem fetch --clear-sources --source https://rubygems.org/ minitest` then `gem generate_index -d /home/victim/trusted-gem-path`
2. Attacker builds malicious minitest gem and places it under `/tmp/attack/home/victim/trusted-gem-path/gems`, runs `gem generate_index`
3. Attacker spoofs DNS SRV response for `_rubygems._tcp.` with target `xxx./tmp/attack`
4. Victim runs `gem fetch --clear-sources --source file:///home/victim/trusted-gem-path minitest`
5. URL rewritten to `file://xxx./tmp/attack/home/victim/trusted-gem-path`, malicious gem installed
**How found:** Noticed api_endpoint is called for all source schemes including file://, and that PR #2035 allowed SRV responses to modify path components; realized empty host in file:// URLs makes the SRV query predictable and the injected prefix exploitable.
**Exploitation:** Attacker on shared filesystem with DNS control spoofs SRV reply to prepend /tmp/attack to victim's file:// source path, causing victim to fetch and install attacker's gem, achieving code execution as victim.
**Insight:** Check whether URL-scheme-agnostic helpers (DNS SRV, redirects, host rewriting) are applied to schemes like file:// or s3:// where host semantics differ; empty-host file URLs make SRV queries predictable and path-injectable.