Collected research
Ruby 2.x Universal RCE Deserialization Gadget Chain
A universal deserialization gadget chain built only from the Ruby standard library loaded by default, so Marshal.load on untrusted bytes runs commands with no gems present and no missing-method call needed. It routes Gem::Requirement through DependencyList, a spaceship comparison and StubSpecification#name into Kernel.open, where a leading pipe executes a shell command on Ruby 2.0 to 2.5.
Record
- Researcher
- Luke Jahnke
- Published by
- elttam.com
- Topic
- Server
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Luke Jahnke, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .