Description

The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because http_connection in lib/gist.rb sets VERIFY_NONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth tokens and login credentials to read and modify the victim's gists.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-10-04T23:16:59.770Z",
  "pubdate": "2026-10-04T23:16:59.770Z",
  "executiveSummary": "The gist RubyGem (versions prior to 6.1.0) is susceptible to a critical improper certificate validation vulnerability. This security flaw stems from the explicit configuration of the HTTP connection library to use OpenSSL::SSL::VERIFY_NONE, effectively disabling TLS/SSL certificate verification for outgoing HTTPS requests.\nThis vulnerability exposes users to on-path attackers capable of performing Man-in-the-Middle (MitM) attacks. By intercepting the encrypted traffic between the client and the GitHub API, an attacker can present an arbitrary or self-signed certificate, which the vulnerable gem will accept without validation. This compromise allows attackers to decrypt, monitor, and modify sensitive data in transit.\nThe primary risk implications involve the exfiltration of OAuth tokens, user credentials, and private gist content. Because the client fails to establish a chain of trust, the confidentiality and integrity of the communication channel are completely nullified. Exploitation requires the attacker to be positioned on the network path between the victim and the target API. No special privileges are required for the victim, as the flaw is triggered automatically during normal gem usage.",
  "technicalDetails": "The root cause of this vulnerability lies within the lib/gist.rb file, specifically in the implementation of the http_connection function. The library initializes the Net::HTTP connection object and explicitly sets the verify_mode attribute to OpenSSL::SSL::VERIFY_NONE. In the context of Ruby's Net::HTTP library, this configuration instructs the underlying SSL/TLS stack to bypass all peer certificate verification processes.\nUnder normal operating conditions, an HTTPS client should verify that the server's certificate is signed by a trusted Certificate Authority (CA) and that the certificate's common name (CN) or Subject Alternative Name (SAN) matches the target hostname. By disabling verification, the gist gem fails to authenticate the identity of the GitHub API server, rendering the TLS tunnel vulnerable to interception.\nThe attack flow proceeds as follows: An attacker positioned on the network path (e.g., via ARP spoofing, DNS poisoning, or compromised routing infrastructure) intercepting traffic destined for api.github.com. When the gist gem initiates an HTTPS request, the attacker intercepts the initial TLS handshake. The attacker presents a malicious certificate to the client. Because the gem has set the verify_mode to VERIFY_NONE, it performs no validation checks on this certificate and completes the handshake, establishing an encrypted tunnel directly to the attacker’s machine instead of the legitimate GitHub server.\nOnce the MitM position is established, the attacker acts as a transparent proxy. The client sends sensitive data—including OAuth authentication tokens and login credentials—over this compromised channel, believing the connection is secure. The attacker can decrypt this traffic in real-time, log the credentials, and potentially inject malicious payloads or modify the content of requests before forwarding them to the actual GitHub API. This allows the attacker to read private gists or modify data on behalf of the victim. The exposure is total within the scope of the gem's network activity, as the victim has no visibility into the lack of identity verification, and the connection appears legitimate to the application process."
}