Web Hack List

Collected research

Ruby 2.x Universal RCE Deserialization Gadget Chain

A universal deserialization gadget chain built only from the Ruby standard library loaded by default, so Marshal.load on untrusted bytes runs commands with no gems present and no missing-method call needed. It routes Gem::Requirement through DependencyList, a spaceship comparison and StubSpecification#name into Kernel.open, where a leading pipe executes a shell command on Ruby 2.0 to 2.5.

Record

Researcher
Luke Jahnke
Published by
elttam.com
Topic
Server

In the archive

Tags

This page is the archive's own catalogue record. The research is the work of Luke Jahnke, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .