Later archive addition

Universal RCE with Ruby YAML.load

Etienne Stalmans · Staaldraad · 2 March 2019

The article adapts a universal Ruby 2.x Marshal deserialization gadget chain to unsafe YAML.load without Rails dependencies. A hand-built YAML object graph drives RubyGems classes through sorting and StubSpecification loading until a pipe-prefixed loaded_from value executes a command.

Record

Researcher

Etienne Stalmans

Published by

Staaldraad

Date

2 March 2019

In the archive

• Added to the 2019 archive after the original list was published

Tags

• ruby
• yaml
• deserialization
• gadget-chain
• rce
• object-injection
• prior-art-extension
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Etienne Stalmans, first published at the original source. Preserved copies are kept so the citation survives its host.