2 ms·
Doesn't this already require to be "on the other side of the airtight hatchway", or am I missing something? The Marshal.load docs explicitly have a warning tha
by Nextgrid 2mo ago
Doesn't this already require to be "on the other side of the airtight hatchway", or am I missing something?
The Marshal.load docs explicitly have a warning that you should not pass it untrusted data: https://docs.ruby-lang.org/en/master/Marshal.html#module-marshal-security-considerations https://docs.ruby-lang.org/en/master/Marshal.html#module-mar...
- Retr0id 2mo agoYes, but that doesn't mean defense-in-depth isn't worth doing. The article discusses how known gadgets were removed in the past.
- superjan 2mo agoYou only need one dev with the bright idea to pass data around via a clientside blob or cookie.
- ksbd-pls-finish 2mo agoIt's not a vulnerability, but it's an exploit. Most vulnerabilities in the wild never have an exploit written, because we mostly assume that for example arbitrary write or buffer overflow are dangerous and "can lead to arbitrary code execution", but actually exploiting them is hard. This is someone who spend some time to write something to actually exploit sites with this vulnerability.