Other nomination

Ruby 3.4 Universal RCE Deserialization Gadget Chain

Luke Jahnke

Refits the universal Ruby deserialisation gadget chain for Ruby 3.4: reaches the URI class through RubyGems' vendored copy via an autoload, swaps the zip sink for tools that ship in official Ruby images, and hides the trailing exception behind an error whose string conversion satisfies the version regex. One deserialisation of attacker data gives command execution.

Record

Researcher

Luke Jahnke

In the archive

• Nominated for the 2024 Top 10 Web Hacking Techniques

Tags

• gadget-chain
• deserialization
• rce
• command-injection
• ruby
• prior-art-extension
• owasp-a03-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Luke Jahnke, first published at the original source. Preserved copies are kept so the citation survives its host.