Profile My skills Saved Collections Edit profile Submit a skill

Ruby Marshal Deserialization

Detects Marshal.load() or Marshal.restore() on untrusted data, enabling code execution.

zakirkun d71f0a4 2 files · 1.9 KB Updated
Coding & Dev Tools

File contents

Ruby Marshal Deserialization

Overview

Ruby's Marshal.load() deserializes a binary format that can instantiate arbitrary Ruby objects. Attackers can craft malicious payloads that invoke initialize, [], and other methods during deserialization, leading to code execution.

This affected Rails versions using Marshal for cookie sessions before 4.x.

Remediation

  • Never use Marshal.load() on untrusted data
  • Use JSON.parse() or MessagePack for data exchange
  • For sessions, use signed/encrypted JSON-based session stores

zakirkun/ice-tea/tree/main/skills/deserialization/ruby-marshal commit d71f0a4062

Browse category

Frequently asked questions

npx skillmds@latest add zakirkun/ruby-marshal-deserialization