ruby-RCE-CVE-2019-5420-

ruby 역직렬화 （CVE-2019-5420） https://github.com/PenTestical/CVE-2019-5420 참고: 1 Ruby on Rails 命令执行漏洞payload实现过程 https://hackerone.com/reports/473888 ActiveSupport::MessageVerifier와 ActiveSupport::MessageEncryptor는 기본 직렬화기serializer로 Marshal을 사용하므로, 객체 주입object injection을 통한 RCE가 가능함을 확인했습니다...

Ruby on Rails: RCE which may occur due to `ActiveSupport::MessageVerifier` or `ActiveSupport::MessageEncryptor` (especially Active storage)

Since ActiveSupport::MessageVerifier and ActiveSupport::MessageEncryptor use Marshal as the default serializer, I confirmed that RCE is possible by object injection. ruby https://github.com/rails/rails/blob/v5.2.2/activesupport/lib/activesupport/messageverifier.rbL110 def initializesecret, option...