shopify-scripts: Struct type confusion RCE

Heya! I've been poking at mruby a bit more and I've found a vulnerability that allows an attacker to take control of the instruction pointer. I've attached a proof of concept script that when run in mruby will jump to 0x0000133713371337 and segfault. While the proof of concept script just jumps t...

shopify-scripts: SIGSEGV when invalid argument on remove_method

There is an invalid memory read on mruby when calling to removemethod with invalid arguments which causes a SIGSEGV which leads into denial of service. Sample The following code tries to remove a method using a nil as argument ruby class Child removemethod nil end There are many other variants,...

shopify-scripts: Segfault in mruby, mruby_engine and the parent MRI Ruby due to null pointer dereference

Introduction ============ Certain valid Ruby programs are able to cause a segmentation fault in mruby through a null pointer derefence, which in turn leads to a crash in mrubyengine and the parent MRI Ruby process. Proof of concept ================ crash.rb: --------- def method yield end method&...

shopify-scripts: Undefined method_missing null pointer dereference

It's possible to segfault mruby by undefining BasicObjectmethodmissing in certain cases. There is a fallback methodmissing C function mrbmethodmissing which is called in some cases when the VM fails to look up the methodmissing method: BasicObject.removemethod:methodmissing; 1.foo NoMethodError:...

shopify-scripts: Range#initialize_copy null pointer dereference

Heya! It's possible to segfault mruby through mruby-engine with the following snippet of code: Range.removemethod:initializecopy 1..2.dup.tos This can be triggered through mruby-engine like this: MRubyEngine.new5121024, 1000, 1000.sandboxeval"/tmp", % Range.removemethod:initializecopy 1..2.dup.to...

shopify-scripts: Use after free vulnerability in mruby Array#to_h causing DOS possible RCE

This bug was found with jmlb337. Vulnerability The function toh will call the C function mrbarytoh. This will iterate through the elements of the array. If an element is not of type Array it will call attempt to call toary method of that object. If toary does not return an array, the function wil...

shopify-scripts: Memory disclosure in mruby String#lines method

This bug was found with jmlb337. Hey again, while reviewing mruby for vulnerabilities, I stumble onto a case that allow an attacker to leak heap content including pointer that can be used along another vulnerability to craft a complete exploit. Reproduction Step 1. Allocate a string with a few...

shopify-scripts: Denial of Service in mruby due to null pointer dereference

Hi, The following file causes a segmentation fault in mruby, which also causes a segmentation fault in mruby-engine. I've minimized this file down to the bare bones what crashes it, and renamed variables so you can see what is needed and what isn't. a="any splat operator", case "any object or nil...

shopify-scripts: Exception cause SIGABRT

Overriding the tos method of an exception and raise it from a sandboxed mruby evaluation result in a abort call from mruby. This results with the whole ruby process terminating. Tested on 4cd4dfc855f0cce18b1ee2f318927c13edb20d14 POC poc.rb class A 2 0x00007fe2ac234bbc in mrbexcraise...