3 ms·

I'm trying to interpret what this means. I think it's saying that a previous result showed that `Marshal.load` on user-supplied input gave an RCE if you were ru

I'm trying to interpret what this means. I think it's saying that a previous result showed that `Marshal.load` on user-supplied input gave an RCE if you were running Rails (basically, see the 3 conditions under "Previous Payloads"), but the new result is that `Marshal.load` is always unsafe, with just the stdlib. Does that sound right to other folks?

tyingq 8y ago
Yes, that's why they are pushing the word universal... "we want to craft a gadget chain that has no dependencies, gadgets can only be sourced from the standard library" But, you would still need to find something that unmarshalls unstrusted input. Don't know how hard that is to find.
woodruffw 8y ago
`Marshal.load` was already always unsafe -- what this changes is the difficulty of writing a malicious payload. Previously (for Marshal anyways, not sure about pickle), you would need to know a least a little bit about how the input is being used, so that you could monkeypatch one of the methods eventually used by it. This makes it possible to get RCE without any knowledge of the codebase.