shopify-scripts: Segfault in mruby, mruby_engine and the parent MRI Ruby due to null pointer dereference

Introduction ============ Certain valid Ruby programs are able to cause a segmentation fault in mruby through a null pointer derefence, which in turn leads to a crash in mrubyengine and the parent MRI Ruby process. Proof of concept ================ crash.rb: --------- def method yield end method&...

shopify-scripts: Undefined method_missing null pointer dereference

It's possible to segfault mruby by undefining BasicObjectmethodmissing in certain cases. There is a fallback methodmissing C function mrbmethodmissing which is called in some cases when the VM fails to look up the methodmissing method: BasicObject.removemethod:methodmissing; 1.foo NoMethodError:...

shopify-scripts: Range#initialize_copy null pointer dereference

Heya! It's possible to segfault mruby through mruby-engine with the following snippet of code: Range.removemethod:initializecopy 1..2.dup.tos This can be triggered through mruby-engine like this: MRubyEngine.new5121024, 1000, 1000.sandboxeval"/tmp", % Range.removemethod:initializecopy 1..2.dup.to...

shopify-scripts: Use after free vulnerability in mruby Array#to_h causing DOS possible RCE

This bug was found with jmlb337. Vulnerability The function toh will call the C function mrbarytoh. This will iterate through the elements of the array. If an element is not of type Array it will call attempt to call toary method of that object. If toary does not return an array, the function wil...

shopify-scripts: Memory disclosure in mruby String#lines method

This bug was found with jmlb337. Hey again, while reviewing mruby for vulnerabilities, I stumble onto a case that allow an attacker to leak heap content including pointer that can be used along another vulnerability to craft a complete exploit. Reproduction Step 1. Allocate a string with a few...

shopify-scripts: Denial of Service in mruby due to null pointer dereference

Hi, The following file causes a segmentation fault in mruby, which also causes a segmentation fault in mruby-engine. I've minimized this file down to the bare bones what crashes it, and renamed variables so you can see what is needed and what isn't. a="any splat operator", case "any object or nil...

shopify-scripts: Exception cause SIGABRT

Overriding the tos method of an exception and raise it from a sandboxed mruby evaluation result in a abort call from mruby. This results with the whole ruby process terminating. Tested on 4cd4dfc855f0cce18b1ee2f318927c13edb20d14 POC poc.rb class A 2 0x00007fe2ac234bbc in mrbexcraise...