rubygems-credentials-exposure: Ruby Gem::ConfigFile Credential - Exposure

id: rubygems-credentials-exposure

info:
  name: Ruby Gem::ConfigFile Credential - Exposure
  author: theamanrawat
  severity: high
  description: |
    Ruby Gem credentials file is exposed, potentially leaking RubyGems API keys. The ~/.gem/credentials file stores authentication tokens for publishing gems to RubyGems.org or private gem servers.
  reference:
    - https://guides.rubygems.org/rubygems-org-api/
    - https://blog.rubygems.org/2020/07/28/api-key-leak.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cwe-id: CWE-200
  metadata:
    verified: false
    max-request: 3
  tags: exposure,rubygems,credentials,config,token,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/.gem/credentials"
      - "{{BaseURL}}/credentials"
      - "{{BaseURL}}/.gem/credentials.yaml"

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - ":rubygems_api_key:"

      - type: word
        part: body
        words:
          - "<html"
          - "<body"
          - "<!DOCTYPE"
          - "<script"
          - "<?php"
        negative: true

      - type: status
        status:
          - 200
# digest: 490a0046304402202b42b7c85840bbb6f34c885fb72ff894d2cf2417759ddd99e308573b7253dacd0220668314b820f884fd5c5cc23fbd5a5ebc7e75b2e609ee4463fa291ded488015c3:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.