A newly disclosed universal deserialization gadget chain shows how a single unsafe Marshal.load operation can reportedly produce remote command execution in Ruby 4.0.6, underscoring the persistent danger of exposing Ruby’s native serialization mechanism to attacker-controlled data. According to research published by elttam, the chain also works unchanged on Ruby versions as far back as 3.3. […]

The post Ruby 4.0 Marshal.load RCE Gadget Chain Exposes Critical Deserialization Risk appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Eswar

Source: gbHackers
Source Link: https://gbhackers.com/ruby-4-0-marshal-load-rce-gadget-chain/