3 ms·
Not long time ago Rails had an attack vector very similar to this, IIRC.
by slig 13y ago
Not long time ago Rails had an attack vector very similar to this, IIRC.
- meowface 13y agoYep, same thing but with YAML deserialization. Deserialization vulnerabilities are common for Java, Python, Ruby, and PHP web apps, because deserializing an untrusted input is nearly akin to running eval() on an untrusted input.
- ambrop7 13y ago1. Define exactly what the deserialization output should be. 2. Implement it that exactly that way. Now it's simple. Does the definition in part (1) include execution of arbitrary commands?
- Robin_Message 13y agoA deserializer might be able to instantiate arbitrary classes, so any class with a constructor that could execute an arbitrary command makes the deserializer vulnerable. Of course, the correct answer is not to use the deserializer that can instantiate arbitrary classes when you have a well-defined list of classes that can be instantiated.