Rogue Ruby Gem Can Publish Librato Credentials (Correction)

UPDATE (1/30/2013 22:00 UTC): After direct discussion with the Rubygems.org maintainers, they've confirmed that Librato users are not impacted, even if they had somehow installed this rogue gem. The exploit gem was specifically targeted to compromise the Librato credentials of Rubygems.org (amongst other credentials). Ruby customers are advised to follow the Rubygems Twitter account for more information.

---

As reported today on Hacker News, a rogue Ruby gem was posted to Rubygems.org earlier today. The gem exercises a weakness in YAML file parsing to read a number of configuration files from the local environment. The gem posted the contents of these files, which can contain secret credentials, to a public site. The list of configuration files the exploit looked for included the librato.yml file that our Librato Rails gem can use to read a customer's Librato email and API token.

The maintainers of Rubygems.org promptly removed the rogue gem from the site after it was reported. However, it is possible that mirrors still have copies of the rogue gem. We believe the gem in question was called "exploit", but there may be variants circulating that use a different name.

If you are using the Librato Rails gem and are using the YAML configuration file, config/librato.yml, to store your Librato credentials we recommend that you change your API token immediately if there is any chance you may have installed one of these rogue gems. You can regenerate your Librato API token by following this knowledge base article.

We are still understanding the potential impact that this issue has on Librato customers. If you believe this may have impacted you and you have more questions, please stop by http://chat.librato.com to talk with us. We will update this thread as we get more information on the impact of this issue.

Moving forward we will investigate ways to reduce the impact of similar issues like this. Included in these discussions will be a move towards signing our own Ruby gems that we publish to Rubygems.org. While this won't address problems such as the above, it will give our customers better assurance in the integrity of our Ruby gems.