Cyber Risks · Trail of Bits Blog

Marshal madness: A brief history of Ruby deserialization exploits

Summary: Trail of Bits traces Ruby Marshal deserialization exploits from Hailey Somerville's January 31, 2013 bug tracker issue through Luke Jahnke's 2018 universal RCE gadget chain to Jahnke's November 2024 Ruby 3.4 gadget chain, which was patched before Ruby 3.4.0 shipped in December 2024. During a security audit of RubyGems.org for Ruby Central, the firm found multiple Marshal-related vulnerabilities rated informational severity, including one that enables the same Gem module gadget chain seen repeatedly.

Bottom line: The same Gem module gadget chain keeps resurfacing in code thousands of developers rely on daily, and a Marshal bug sat untouched for 16 years before surfacing in a Ruby 3.4 release candidate - patching symptoms has not closed the class of vulnerability.

Read the original at Trail of Bits Blog ↗