3 ms·

This is interesting, although not that novel. Marshal deserialization has always been unsafe, and in > 10 years as a Ruby engineer I’ve never seen it used in a

This is interesting, although not that novel. Marshal deserialization has always been unsafe, and in > 10 years as a Ruby engineer I’ve never seen it used in a production system. I would guess that finding a system vulnerable to this exploit would be a more interesting story than the exploit itself.

throwaway427 8y ago
As it were we can get an idea of in-the-wild usage here, https://github.com/search?l=Ruby&p=6&q=Marshal.load&type=Code https://github.com/search?l=Ruby&p=6&q=Marshal.load&type=Cod... and it's mostly test code.
JohnBooty 8y ago
I've only done Ruby half as long and yeah, this is my experience as well. It's tough to think of a use case where anybody would even want to do this. "Hey, let's let users upload.... arbitrary binary representations.... of.... Ruby objects? And then deserialize them! YEAH! PROFIT!!!! SYNERGY!!! WOOOOOOO!!!!"
HackAllThings 8y ago
As a pen tester, I wholeheartedly disagree. It’s probably more common to see unsafe YAML deserialization, rather than directly deserializing marshaled Ruby objects, but both are impactful and these types of vulnerabilities do exist. Just recently I assessed an application that used unsafe serialization to pass around an object encoded in the value of a cookie. It contained transient data related to the user’s session (e.g. what page they last visited). Last year I assessed an application that allowed users to upload YAML files, which would get parsed and deseralized as Ruby objects. Unfortunately I didn’t have a universal gadget chain then, so I had to note it as theoretically exploitable in my report. That’s troublesome because some clients may take it less seriously. I’m personally very impressed with this research and I think it does a net good, demonstrating that deserialization of Ruby objects in any form is unsafe when you can’t trust the input.
lostapathy 8y ago
I have seen marshal show up in the bowels of gems where one wouldnt expect it, and most users obviously aren’t digging through gem sources.

throwaway427 8y ago

As it were we can get an idea of in-the-wild usage here, https://github.com/search?l=Ruby&p=6&q=Marshal.load&type=Code https://github.com/search?l=Ruby&p=6&q=Marshal.load&type=Cod... and it's mostly test code.

JohnBooty 8y ago

I've only done Ruby half as long and yeah, this is my experience as well. It's tough to think of a use case where anybody would even want to do this. "Hey, let's let users upload.... arbitrary binary representations.... of.... Ruby objects? And then deserialize them! YEAH! PROFIT!!!! SYNERGY!!! WOOOOOOO!!!!"

HackAllThings 8y ago

As a pen tester, I wholeheartedly disagree. It’s probably more common to see unsafe YAML deserialization, rather than directly deserializing marshaled Ruby objects, but both are impactful and these types of vulnerabilities do exist. Just recently I assessed an application that used unsafe serialization to pass around an object encoded in the value of a cookie. It contained transient data related to the user’s session (e.g. what page they last visited). Last year I assessed an application that allowed users to upload YAML files, which would get parsed and deseralized as Ruby objects. Unfortunately I didn’t have a universal gadget chain then, so I had to note it as theoretically exploitable in my report. That’s troublesome because some clients may take it less seriously. I’m personally very impressed with this research and I think it does a net good, demonstrating that deserialization of Ruby objects in any form is unsafe when you can’t trust the input.

lostapathy 8y ago

I have seen marshal show up in the bowels of gems where one wouldnt expect it, and most users obviously aren’t digging through gem sources.